More information about Dirty COW (aka CVE-2016-5195)

[Posted October 20, 2016 by jake]

The security hole fixed in the 4.8.3, 4.7.9, and 4.4.26 stable kernel updates has been dubbed Dirty COW (CVE-2016-5195) by a site devoted to the kernel privilege escalation vulnerability. There is some indication that it is being exploited in the wild. Ars Technica has some additional information. The Red Hat bugzilla entry and advisory are worth looking at as well.

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 21:33 UTC (Thu) by evad (subscriber, #60553) [Link] (9 responses)

Eugh, why is that website advocating donating to the FreeBSD project, and why does it have a shop to buy 'merchandise' for a security flaw?

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 21:39 UTC (Thu) by GhePeU (subscriber, #56133) [Link]

And it's not even associated with the discoverer of the vulnerability. Somebody trying to cash in? Personally I'd remove the link.

Dirty Cow merchandise

Posted Oct 20, 2016 22:10 UTC (Thu) by corbet (editor, #1) [Link] (1 responses)

A quick look at the pricing in the "shop" suggests that this is not actually a serious commercial endeavor...

Dirty Cow merchandise

Posted Oct 21, 2016 15:51 UTC (Fri) by zblaxell (subscriber, #26385) [Link]

Pity. The logo is mildly endearing and I could use a reasonably-priced tote bag. ;)

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 22:35 UTC (Thu) by spender (guest, #23067) [Link] (3 responses)

Probably because FreeBSD fixed a similar flaw in 2013. I suppose the recitation of Linus' "a bug is a bug" quote also went over your head ;) The site is quite clearly a parody of a number of things.

-Brad

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 22:53 UTC (Thu) by mjg59 (subscriber, #23239) [Link] (1 responses)

All it's really missing is an acknowledgment that given enough eyeballs, all bugs are shallow

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 23:45 UTC (Thu) by spender (guest, #23067) [Link]

The jokes write themselves:
https://github.com/dirtycow/dirtycow.github.io/issues/3

-Brad

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 23:34 UTC (Thu) by robert_p (guest, #110578) [Link]

"In fact, all the boring normal bugs are _way_ more important, just because there's a lot more of them. I don't think some spectacular security hole should be glorified or cared about as being any more "special" than a random spectacular crash due to bad locking."

It would be funny if it wasn't reality and pretty much a 1:1 quote.

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 22:39 UTC (Thu) by itvirta (guest, #49997) [Link] (1 responses)

Even a ladies t-shirt listed, that's brave.

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 21, 2016 13:40 UTC (Fri) by adobriyan (subscriber, #30858) [Link]

Someone should cash in on ALLCAPS VULN Wordpress template by now.

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 23:25 UTC (Thu) by luto (guest, #39314) [Link] (2 responses)

I'm curious who made the Dirty COW site.

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 23:40 UTC (Thu) by spender (guest, #23067) [Link] (1 responses)

As am I, since it seems a ton of people were in on this embargo and sitting on the information (that they then, with the exception of RH, didn't share with the rest of the world once the embargo was over). Also, though I haven't done a super thorough investigation, it seems that the creation of the twitter account predated any public mention I could find of the vulnerability being embargoed. The link I originally pasted was the first I found, and that was already late yesterday.

-Brad

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 20, 2016 23:45 UTC (Thu) by luto (guest, #39314) [Link]

It could be someone from the wider "distros" world. I blew it and notified the distros list (instead of the linux-distros list) last week.

Anyway, my non-weaponized reproducer will be unembargoed Wednesday next week.

What about all the Android junk out there?

Posted Oct 21, 2016 1:44 UTC (Fri) by bojan (subscriber, #14302) [Link] (4 responses)

If that's also exploitable, there is like a billion devices to be taken over. Scary stuff. Anyone knows what is the status there?

What about all the Android junk out there?

Posted Oct 21, 2016 16:11 UTC (Fri) by zblaxell (subscriber, #26385) [Link] (3 responses)

Earlier this year there were something like 200 viable Android root exploits commercially available. So...now there's 201?

What about all the Android junk out there?

Posted Oct 21, 2016 18:50 UTC (Fri) by bojan (subscriber, #14302) [Link] (2 responses)

Wow, that bad, eh? Android sucks so badly when it comes to security, someone at Google should really get sacked for it. The nonsensical idea of throwing these releases/devices over the fence and forgetting about them truly had its days.

What about all the Android junk out there?

Posted Oct 21, 2016 20:07 UTC (Fri) by nix (subscriber, #2304) [Link]

On the upside, it does mean that even locked devices are trivially rootable.

(On the downside... including over the air, by people other than the owner.)

What about all the Android junk out there?

Posted Oct 21, 2016 22:34 UTC (Fri) by zlynx (guest, #2285) [Link]

Google does scan their app store for suspicious code and block most of it.

In my admittedly limited experience the hacked phones mostly got it through some third-party store or manually installed APK.

More information about Dirty COW (aka CVE-2016-5195)

Posted Oct 21, 2016 11:33 UTC (Fri) by arekm (guest, #4846) [Link]

Doh, 4.1 longterm is lagging again with fixes.