Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "5"
},
{
"introduced": "0"
},
{
"last_affected": "6.0"
},
{
"introduced": "0"
},
{
"last_affected": "6.2"
},
{
"introduced": "0"
},
{
"last_affected": "6.4"
},
{
"introduced": "0"
},
{
"last_affected": "6.5"
},
{
"introduced": "0"
},
{
"last_affected": "6.6"
},
{
"introduced": "0"
},
{
"last_affected": "6.7"
},
{
"introduced": "0"
},
{
"last_affected": "5.6"
},
{
"introduced": "0"
},
{
"last_affected": "5.9"
},
{
"introduced": "0"
},
{
"last_affected": "6.5"
}
]
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5195.json"
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "14.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.10"
}
]
},
{
"events": [
{
"introduced": "2.6.22"
},
{
"fixed": "3.2.83"
}
]
},
{
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.4.113"
}
]
},
{
"events": [
{
"introduced": "3.5"
},
{
"fixed": "3.10.104"
}
]
},
{
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.12.66"
}
]
},
{
"events": [
{
"introduced": "3.13"
},
{
"fixed": "3.16.38"
}
]
},
{
"events": [
{
"introduced": "3.17"
},
{
"fixed": "3.18.44"
}
]
},
{
"events": [
{
"introduced": "3.19"
},
{
"fixed": "4.1.35"
}
]
},
{
"events": [
{
"introduced": "4.2"
},
{
"fixed": "4.4.26"
}
]
},
{
"events": [
{
"introduced": "4.5"
},
{
"fixed": "4.7.9"
}
]
},
{
"events": [
{
"introduced": "4.8"
},
{
"fixed": "4.8.3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "23"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "24"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "25"
}
]
},
{
"events": [
{
"introduced": "5.1"
},
{
"fixed": "7.0.14"
}
]
},
{
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.8"
}
]
}
]
[
{
"signature_version": "v1",
"target": {
"file": "mm/gup.c",
"function": "follow_page_pte"
},
"source": "https://github.com/torvalds/linux/commit/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619",
"deprecated": false,
"digest": {
"function_hash": "244365433434225671318189218337047827727",
"length": 2112.0
},
"id": "CVE-2016-5195-5a4b3bdf",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "mm/gup.c",
"function": "faultin_page"
},
"source": "https://github.com/torvalds/linux/commit/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619",
"deprecated": false,
"digest": {
"function_hash": "50421871060394395735251860327609164320",
"length": 1314.0
},
"id": "CVE-2016-5195-e85ca0b4",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "mm/gup.c"
},
"source": "https://github.com/torvalds/linux/commit/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619",
"deprecated": false,
"digest": {
"line_hashes": [
"107296051698005598711935602990655601534",
"166319132010357855846718976157947066238",
"156408199746299444283773708959921347899",
"38947057551910675309410968469537323577",
"34248897889181233149835289522709820766",
"73498796390470188382657537258464211120",
"25949660698751557286033558091716060066",
"225375715742739344060183097165380188616",
"31182718635998019876352406878668256939",
"2607421179662326112828314412569269355",
"270521724802145802645466946366552999591"
],
"threshold": 0.9
},
"id": "CVE-2016-5195-f0f5f870",
"signature_type": "Line"
}
]