CVE-2016-5195: Dirty COW
A race condition in the Linux kernel's memory subsystem, in how copy-on-write handles private read-only memory mappings. A local attacker can win the race to gain write access to memory that should be read-only, including files owned by root, and use it to escalate to root privileges.
View the authoritative record on NVD ↗Affected software
- Linux kernel versions from 2.6.22 (2007) through the fix in 4.8.3 (2016), and vendor kernels built on that range
How it's exploited
Run two threads against a mapped read-only file, one repeatedly calling madvise(MADV_DONTNEED) while the other writes through /proc/self/mem, racing the kernel's copy-on-write handling so the write lands on the underlying read-only page.
Severity
CVE-2016-5195 carries a CVSS 3.0 base score of 7.8, rated High. See how CVSS scoring works or score a vulnerability yourself with the free CVSS calculator.
Weakness type
CVE-2016-5195 is categorized under CWE-362, the general weakness pattern behind this specific vulnerability.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Remediation
Apply the kernel patch (mainline 4.8.3 or the equivalent vendor backport) and reboot affected systems; there is no configuration-only workaround.
Frequently asked questions
What is CVE-2016-5195?
A race condition in the Linux kernel's memory subsystem, in how copy-on-write handles private read-only memory mappings. A local attacker can win the race to gain write access to memory that should be read-only, including files owned by root, and use it to escalate to root privileges.
How severe is CVE-2016-5195?
CVE-2016-5195 has a CVSS 3.0 base score of 7.8 out of 10, rated High.
What software is affected by CVE-2016-5195?
CVE-2016-5195 affects Linux kernel versions from 2.6.22 (2007) through the fix in 4.8.3 (2016), and vendor kernels built on that range.
How do you fix CVE-2016-5195?
Apply the kernel patch (mainline 4.8.3 or the equivalent vendor backport) and reboot affected systems; there is no configuration-only workaround.
Where is the authoritative record for CVE-2016-5195?
The National Vulnerability Database (NVD) publishes the authoritative record for CVE-2016-5195 at https://nvd.nist.gov/vuln/detail/CVE-2016-5195, including the current CVSS score, CWE mapping, and affected-configuration data.
Related CVEs
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find known-vulnerable services before an attacker does
TurboPentest fingerprints every open port and web service, then matches detected versions against known CVEs automatically, from $99 per target.
Start a pentest