Intel

CVE-2016-5195

Linux Kernel — Linux Kernel Race Condition Vulnerability

criticalKEV: actively exploitedPoCEPSS 84%

Description

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

Source: CISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

Dirty COW is one of the most widely recognised Linux privilege-escalation vulnerabilities ever published, with an EPSS score of 83.5 % (99.7th percentile) reflecting the near-certainty of exploitation attempts against any exposed system. The CVSS v3 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is local-only, but that constraint is routinely satisfied in shared-shell environments, CI/CD pipelines, multi-tenant container hosts, and any system where SSH access is granted to more than one user. For NIS2-scoped organisations, priority should be treated as critical wherever unpatched Linux hosts carry interactive user sessions; the absence of the CISA ransomware-campaign flag does not diminish the risk, as the vulnerability is a reliable stepping stone in post-exploitation chains leading to full host compromise and lateral movement.

Runbook · Step 1

Immediate response (0-24 h)

  • Check the kernel version on all Linux systems (uname -r): any kernel from 2.x through 4.x before 4.8.3 is vulnerable — apply the distribution vendor patch immediately (RHEL/CentOS: RHSA-2016:2098 or equivalent; Ubuntu: USN-3107-1 / USN-3107-2; Debian: DSA-3696-1).
  • Systems that cannot be patched immediately should have interactive user access restricted to the minimum necessary set of authenticated accounts — Dirty COW requires local code execution, so the primary attack surface is SSH, web shells, or shared-shell environments.
  • Audit all interactive user accounts on affected hosts for unexpected UID-0 entries or new SUID binaries: find / -perm -4000 -user root 2>/dev/null.
  • Inspect running process trees for suspicious child processes spawned by web servers, database services, or container runtimes (ps auxf or EDR process-ancestry view).
  • On container hosts (Docker, LXC, Kubernetes nodes), confirm the host kernel is patched — containers share the host kernel and are directly exposed regardless of image hardening.
  • After patching, reboot the host to activate the new kernel; evaluate kexec as a low-downtime alternative only if a full reboot is operationally impossible.

Runbook · Step 2

Mitigation layers

  • Network segmentation / access control: Restrict SSH access to bastion hosts; disable direct interactive logins on production systems. Every reduction in the number of local users directly shrinks the exploitable attack surface.
  • Least privilege / IAM: Minimise unprivileged user accounts; audit and trim sudo entries (visudo, /etc/sudoers.d/) to remove any unnecessary privilege grants.
  • Kernel hardening (short-term): Set vm.mmap_min_addr to a higher value (sysctl -w vm.mmap_min_addr=65536) to reduce null-pointer exploit paths — note this does not fully block Dirty COW itself. Enforce SELinux or AppArmor in enforcing mode to raise the cost of post-exploitation steps.
  • File integrity monitoring: Apply AIDE or equivalent FIM to critical binaries and /etc/passwd, /etc/shadow — Dirty COW is frequently used to overwrite these files directly to add a root-level backdoor account.
  • Container isolation: Enable seccomp profiles and user namespaces; block --privileged container launches via OPA/Gatekeeper policy or Kubernetes Pod Security Admission.
  • Audit logging: Enable auditd rules for write access to /proc/self/mem and /proc/*/mem before the patch is deployed (see Detection rules).

Runbook · Step 3

Detection rules

  • auditd — /proc/self/mem writes: -a always,exit -F arch=b64 -S write -F path=/proc/self/mem -k dirtycow — alert on every hit; legitimate use of this path is extremely rare in production environments.
  • auditd — passwd/shadow modification: Monitor write access to /etc/passwd and /etc/shadow by any process other than passwd, useradd, or chpasswd: -w /etc/passwd -p wa -k passwd_modification.
  • Sysmon (Linux) / EDR process tree: Alert when a process running as a non-root UID spawns a child process with UID 0 — Sigma shape: EventID: 1, User: != root, ParentUser: != root, IntegrityLevel: System.
  • KQL (Microsoft Sentinel / Defender for Endpoint): DeviceProcessEvents | where InitiatingProcessAccountSid != "S-1-5-18" and AccountSid == "S-1-5-18" | where FileName in ("bash","sh","python","perl") — catches the privilege-escalation moment when a root-context shell is spawned from a non-root parent.
  • Network telemetry (Zeek / Suricata): Correlate outbound connections from processes with an unexpected UID-0 context shortly after a non-root user login event — join auth.log entries with netflow to surface post-exploitation lateral movement or C2 beaconing.

Metrics

Severity
critical
Priority score
160.86
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
83.5 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-03-03 00:00 UTC
CWE
—

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2016-5195