CVE-2016-5195 - Kernel local privilege escalation (exploited)

dcc

Hi all,

Just noticed this:
https://access.redhat.com/security/vulnerabilities/2706661

Looks like anyone with local access can get root. Exploits are in the wild.

Upon further checking, doesn't look like this can be used to break out of an OpenVZ container or KVM guest as access to host's /proc/self/mem is required. However, anyone within a shared hosting setup (cPanel etc) could be affected.

Mitigation (not ideal, but works):
https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13

William

Some days old - Should not affect Cloudlinux or RHEL 5/6 (but 7). I think kernelcare patched my Cloudlinux 7.

dcc said: guest as access to host's /proc/self/mem

Why am i not even surprised this exploit exists...

A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings

Didn't we have that already...

The in the wild exploit we are aware of doesn't work on Red Hat Enterprise Linux 5 and 6 out of the box because on one side of the race it writes to /proc/self/mem, but /proc/self/mem is not writable on Red Hat Enterprise Linux 5 and 6.

ok...? Should i now rather ask why they did that or why CentOS has it likely writeable then?

rincewind

Details

Proof of concept