CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a
02 Description
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a
03 Exploitation and scoring
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2022-03-03. Federal remediation due 2022-03-24.
- SSVC decision
- ExploitationactiveCISA reports credible evidence of active exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 83.52% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 99.6% of scored records. A rank, not a probability.
- NVD base score
- 7.0 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Important. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2016-11-10 21:00Z9 YR AGO
- Last updated
- 2025-11-04 16:09Z11 MO AGO
- Reserved
- 2016-05-31
- Assigning CNA
- Chrome
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.0)
- CNA CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Class
- Data version
- 5.2
- Document digest
- d9ddcde05494d5d257c8148656fe9797e66e70ee8b2e470a04cb643c8763622b
05 Affected products
06 References
- rhn.redhat.comRHSA-2016:2107http://rhn.redhat.com/errata/RHSA-2016-2107.html
- www.exploit-db.com40616https://www.exploit-db.com/exploits/40616/
- access.redhat.comRHSA-2017:0372https://access.redhat.com/errata/RHSA-2017:0372
- bto.bluecoat.comhttps://bto.bluecoat.com/security-advisory/sa134
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05352241
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- www.exploit-db.com40839https://www.exploit-db.com/exploits/40839/
- dirtycow.ninjahttps://dirtycow.ninja
- www.exploit-db.com40847https://www.exploit-db.com/exploits/40847/
- rhn.redhat.comRHSA-2016:2118http://rhn.redhat.com/errata/RHSA-2016-2118.html
- rhn.redhat.comRHSA-2016:2128http://rhn.redhat.com/errata/RHSA-2016-2128.html
- source.android.comhttps://source.android.com/security/bulletin/2016-12-01.html
- rhn.redhat.comRHSA-2016:2120http://rhn.redhat.com/errata/RHSA-2016-2120.html
- www.openwall.com[oss-security] 20161026 Re: CVE-2016-5195 "Dirty COW" Linux kernel privilege escalation vulnerabilityhttp://www.openwall.com/lists/oss-security/2016/10/26/7
- rhn.redhat.comRHSA-2016:2133http://rhn.redhat.com/errata/RHSA-2016-2133.html
- rhn.redhat.comRHSA-2016:2098http://rhn.redhat.com/errata/RHSA-2016-2098.html
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03761en_us
- www.kb.cert.orgVU#243144https://www.kb.cert.org/vuls/id/243144
- bugzilla.suse.comhttps://bugzilla.suse.com/show_bug.cgi?id=1004418
- www.securitytracker.com1037078http://www.securitytracker.com/id/1037078
- people.canonical.comhttps://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5195.html
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03722en_us
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20161025-0001/
- www.securityfocus.com93793http://www.securityfocus.com/bid/93793
- rhn.redhat.comRHSA-2016:2127http://rhn.redhat.com/errata/RHSA-2016-2127.html
- security-tracker.debian.orghttps://security-tracker.debian.org/tracker/CVE-2016-5195
- github.comhttps://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03742en_us
- github.comhttps://github.com/torvalds/linux/commit/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
- help.ecostruxureit.comhttps://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
- github.comhttps://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1384344
- access.redhat.comhttps://access.redhat.com/security/vulnerabilities/2706661
- rhn.redhat.comRHSA-2016:2106http://rhn.redhat.com/errata/RHSA-2016-2106.html
- git.kernel.orghttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
- www.exploit-db.com40611https://www.exploit-db.com/exploits/40611/
- access.redhat.comhttps://access.redhat.com/security/cve/cve-2016-5195
- source.android.comhttps://source.android.com/security/bulletin/2016-11-01.html
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541
- rhn.redhat.comRHSA-2016:2124http://rhn.redhat.com/errata/RHSA-2016-2124.html
- www.kernel.orghttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.3
- rhn.redhat.comRHSA-2016:2105http://rhn.redhat.com/errata/RHSA-2016-2105.html
- rhn.redhat.comRHSA-2016:2126http://rhn.redhat.com/errata/RHSA-2016-2126.html
- rhn.redhat.comRHSA-2016:2132http://rhn.redhat.com/errata/RHSA-2016-2132.html
- rhn.redhat.comRHSA-2016:2110http://rhn.redhat.com/errata/RHSA-2016-2110.html
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03707en_us
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05341463
- kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10176
- lists.opensuse.orgSUSE-SU-2016:2635http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00055.html
- lists.opensuse.orgSUSE-SU-2016:2659http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00067.html
- www.openwall.com[oss-security] 20161027 CVE-2016-5195 test casehttp://www.openwall.com/lists/oss-security/2016/10/27/13
- www.ubuntu.comUSN-3106-2http://www.ubuntu.com/usn/USN-3106-2
- lists.opensuse.orgopenSUSE-SU-2016:2583http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00034.html
- packetstormsecurity.comhttp://packetstormsecurity.com/files/139277/Kernel-Live-Patch-Security-Notice-LSN-0012-1.html
- lists.opensuse.orgSUSE-SU-2016:2633http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00053.html
- www.huawei.comhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-dirtycow-en
- lists.opensuse.orgSUSE-SU-2016:2638http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00058.html
- lists.opensuse.orgopenSUSE-SU-2016:2584http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.html
- packetstormsecurity.comhttp://packetstormsecurity.com/files/142151/Kernel-Live-Patch-Security-Notice-LSN-0021-1.html
- lists.opensuse.orgSUSE-SU-2016:2658http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00066.html
- lists.opensuse.orgSUSE-SU-2016:2631http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00051.html
- www.ubuntu.comUSN-3106-3http://www.ubuntu.com/usn/USN-3106-3
- h20566.www2.hpe.comhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05352241
- lists.opensuse.orgSUSE-SU-2016:2655http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00064.html
- lists.fedoraproject.orgFEDORA-2016-c3558808cdhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3APRVDVPDBXLH4DC5UKZVCR742MJIM3/
- www.securityfocus.com20170615 [security bulletin] HPESBGN03761 rev.1 - HPE Virtualization Performance Viewer (VPV)/ Cloud Optimizer using Linux, Remote Escalation of Privilegehttp://www.securityfocus.com/archive/1/archive/1/540736/100/0/threaded
- lists.opensuse.orgSUSE-SU-2016:2637http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00057.html
- lists.opensuse.orgSUSE-SU-2016:2596http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00040.html
- lists.opensuse.orgSUSE-SU-2016:2634http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00054.html
- tools.cisco.com20181107 Cisco TelePresence Video Communication Server Test Validation Script Issuehttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-vcsd
- tools.cisco.com20161026 Vulnerability in Linux Kernel Affecting Cisco Products: October 2016http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-linux
- kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10770
- kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10177
- lists.opensuse.orgSUSE-SU-2016:2657http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00065.html
- lists.opensuse.orgSUSE-SU-2016:2614http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00045.html
- www.ubuntu.comUSN-3105-2http://www.ubuntu.com/usn/USN-3105-2
- www.ubuntu.comUSN-3107-1http://www.ubuntu.com/usn/USN-3107-1
- kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10774
- www.ubuntu.comUSN-3107-2http://www.ubuntu.com/usn/USN-3107-2
- www.securityfocus.com20170331 [security bulletin] HPESBGN03722 rev.1 - HPE Operations Agent, Local Escalation of Privilegehttp://www.securityfocus.com/archive/1/540344/100/0/threaded
- lists.opensuse.orgopenSUSE-SU-2016:2625http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00048.html
- www.ubuntu.comUSN-3106-1http://www.ubuntu.com/usn/USN-3106-1
- www.ubuntu.comUSN-3106-4http://www.ubuntu.com/usn/USN-3106-4
- www.openwall.com[oss-security] 20161030 Re: CVE-2016-5195 test casehttp://www.openwall.com/lists/oss-security/2016/10/30/1
- packetstormsecurity.comhttp://packetstormsecurity.com/files/139923/Linux-Kernel-Dirty-COW-PTRACE_POKEDATA-Privilege-Escalation.html
- lists.opensuse.orgSUSE-SU-2016:2673http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00072.html
- www.ubuntu.comUSN-3104-2http://www.ubuntu.com/usn/USN-3104-2
- fortiguard.comhttp://fortiguard.com/advisory/FG-IR-16-063
- kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10807
- lists.opensuse.orgSUSE-SU-2016:2629http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00049.html
- www.securityfocus.com20161020 [CVE-2016-5195] "Dirty COW" Linux privilege escalation vulnerabilityhttp://www.securityfocus.com/archive/1/539611/100/0/threaded
- packetstormsecurity.comhttp://packetstormsecurity.com/files/139922/Linux-Kernel-Dirty-COW-PTRACE_POKEDATA-Privilege-Escalation.html
- lists.opensuse.orgSUSE-SU-2016:2632http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00052.html
- www.securityfocus.com20170310 [security bulletin] HPESBGN03707 rev.1 - HPE ConvergedSystem 700 2.0 VMware Kit, Remote Increase of Privilegehttp://www.securityfocus.com/archive/1/archive/1/540252/100/0/threaded
- www.ubuntu.comUSN-3105-1http://www.ubuntu.com/usn/USN-3105-1
- packetstormsecurity.comhttp://packetstormsecurity.com/files/139286/DirtyCow-Linux-Kernel-Race-Condition.html
- lists.opensuse.orgSUSE-SU-2016:2630http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00050.html
- lists.fedoraproject.orgFEDORA-2016-db4b75b352https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E7M62SRP6CZLJ4ZXCRZKV4WPLQBSR7DT/
- lists.fedoraproject.orgFEDORA-2016-c8a0c7eecehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWMDLBWMGZKFHMRJ7QUQVCERP5QHDB6W/
- www.openwall.com[oss-security] 20161103 Re: CVE-2016-5195 "Dirty COW" Linux kernel privilege escalation vulnerabilityhttp://www.openwall.com/lists/oss-security/2016/11/03/7
- lists.opensuse.orgSUSE-SU-2016:2636http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00056.html
- lists.opensuse.orgSUSE-SU-2016:3069http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00033.html
- kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10222
- www.debian.orgDSA-3696http://www.debian.org/security/2016/dsa-3696
- packetstormsecurity.comhttp://packetstormsecurity.com/files/139287/DirtyCow-Local-Root-Proof-Of-Concept.html
- lists.opensuse.orgSUSE-SU-2016:2592http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00038.html
- www.securityfocus.com20170331 [security bulletin] HPESBGN03722 rev.1 - HPE Operations Agent, Local Escalation of Privilegehttp://www.securityfocus.com/archive/1/archive/1/540344/100/0/threaded
- www.securityfocus.com20161020 [CVE-2016-5195] "Dirty COW" Linux privilege escalation vulnerabilityhttp://www.securityfocus.com/archive/1/archive/1/539611/100/0/threaded
- www.ubuntu.comUSN-3104-1http://www.ubuntu.com/usn/USN-3104-1
- www.securityfocus.com20170615 [security bulletin] HPESBGN03761 rev.1 - HPE Virtualization Performance Viewer (VPV)/ Cloud Optimizer using Linux, Remote Escalation of Privilegehttp://www.securityfocus.com/archive/1/540736/100/0/threaded
- lists.opensuse.orgSUSE-SU-2016:2593http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00039.html
- lists.opensuse.orgSUSE-SU-2016:3304http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00100.html
- www.openwall.com[oss-security] 20161021 CVE-2016-5195 "Dirty COW" Linux kernel privilege escalation vulnerabilityhttp://www.openwall.com/lists/oss-security/2016/10/21/1
- www.securityfocus.com20170310 [security bulletin] HPESBGN03707 rev.1 - HPE ConvergedSystem 700 2.0 VMware Kit, Remote Increase of Privilegehttp://www.securityfocus.com/archive/1/540252/100/0/threaded
- lists.opensuse.orgSUSE-SU-2016:2585http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00036.html
- lists.opensuse.orgopenSUSE-SU-2016:2649http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00063.html
- security.paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2016-5195
- lists.opensuse.orgopenSUSE-SU-2020:0554http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- www.arista.comhttps://www.arista.com/en/support/advisories-notices/security-advisories/1753-security-advisory-0026
- www.openwall.com[oss-security] 20220307 CVE-2022-0847: Linux kernel: overwriting read-only fileshttp://www.openwall.com/lists/oss-security/2022/03/07/1
- www.openwall.com[oss-security] 20220808 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissionshttp://www.openwall.com/lists/oss-security/2022/08/08/2
- www.openwall.com[oss-security] 20220808 CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissionshttp://www.openwall.com/lists/oss-security/2022/08/08/1
- www.openwall.com[oss-security] 20220808 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissionshttp://www.openwall.com/lists/oss-security/2022/08/08/7
- www.openwall.com[oss-security] 20220808 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissionshttp://www.openwall.com/lists/oss-security/2022/08/08/8
- www.openwall.com[oss-security] 20220809 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissionshttp://www.openwall.com/lists/oss-security/2022/08/09/4
- www.openwall.com[oss-security] 20220815 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissionshttp://www.openwall.com/lists/oss-security/2022/08/15/1
- seclists.orghttp://seclists.org/fulldisclosure/2024/Aug/35
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-5195
07 Fixed in
Arch Linux
- linux Fixed in 4.8.3-1
- linux-lts Fixed in 4.4.26-1
Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.
Debian 12
- linux Fixed in 4.7.8-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- linux Fixed in 4.7.8-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- linux Fixed in 4.7.8-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 14.04 LTS
- linux Fixed in 3.13.0-100.147
- linux-lts-vivid Fixed in 3.19.0-73.81~14.04.1
- linux-lts-xenial Fixed in 4.4.0-45.66~14.04.1
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 16.04 LTS
- linux Fixed in 4.4.0-45.66
- linux-raspi2 Fixed in 4.4.0-1029.36
- linux-snapdragon Fixed in 4.4.0-1032.36
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.