Arch Linux alert ASA-201610-14 (kernel)

From:
    	     
 
Levente Polyak <anthraxx@archlinux.org> 
To:
    	     
 
arch-security@archlinux.org 
Subject:
    	     
 
[arch-security] [ASA-201610-14] linux: privilege escalation 
Date:
    	     
 
Sat, 22 Oct 2016 14:03:47 +0200
Message-ID:
    	     
 
<80d25f1f-0ea3-59af-23e9-b14be0b2d212@archlinux.org>
Arch Linux Security Advisory ASA-201610-14
==========================================

Severity: High
Date    : 2016-10-22
CVE-ID  : CVE-2016-5195
Package : linux
Type    : privilege escalation
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package linux before version 4.8.3-1 is vulnerable to privilege
escalation.

Resolution
==========

Upgrade to 4.8.3-1.

# pacman -Syu "linux>=4.8.3-1"

The problem has been fixed upstream in version 4.8.3.

Workaround
==========

None.

Description
===========

A race condition was found in the way the Linux kernel's memory
subsystem handled the copy-on-write (COW) breakage of private read-only
memory mappings. An unprivileged local user could use this flaw to gain
write access to otherwise read-only memory mappings and thus increase
their privileges on the system.

Impact
======

An unprivileged local attacker is able to elevate their privileges on
the system and gain root access.

References
==========

https://bugzilla.redhat.com/show_bug.cgi?id=1384344
https://github.com/dirtycow/dirtycow.github.io/wiki/Vulne...
https://git.kernel.org/cgit/linux/kernel/git/torvalds/lin...
https://access.redhat.com/security/cve/CVE-2016-5195