Earlier we talked about a potential security crisis in the Linux kernel. Experts have debated it endlessly, but bugs keep appearing, and the latest has been on the run for nearly a decade. Known as Dirty COW or CVE-2016-5195, this bug allows a user to escalate their privileges in a matter of seconds, and that's not all. Dirty COW was first detected nine years ago, Linus Torvalds himself tried to fix it, a later update caused a regression, and it has been floating in digital limbo ever since.
Nine years, a loose exploit, and the same old story. Code is only as good as the people who write it, and despite the effort, dedication, training, and commitment of experts, that whole battalion of eyes is not enough to catch every bug that appears. This situation applies to software in general, but the Linux kernel is such an important element that when a vulnerability is discovered inside it, it's inevitable to look closer. The chances of a bug remaining in the kernel for years are quite high. The average is about five years, but today's news throws that average out the window...
The stage name for the vulnerability is Dirty COW, and technically it's known as CVE-2016-5195. Its advanced description speaks of a race condition (something fairly common within everything) detected in the way the kernel's memory subsystem handles a duplication technique called Copy-On-Write. Through this flaw, a user can obtain write access to memory maps that would normally be read-only, leading to a privilege escalation. The researcher and developer Phil Oester was the one who discovered the exploit, which he identifies as "compiled with GCC 4.8.5 dated 20150623", although that doesn't prevent said exploit from having been on the Web for longer, due to the age of the bug. How old is it? According to Linus Torvalds himself, nine years, and he admits that his fix was quite poor. Why? Because a later update brought it back, and it has been with us since 2007.
As expected, Dirty COW has already been fixed by the kernel maintainers, but now it's time to update, which obviously won't reach all affected devices. Distro users should be receiving the necessary alerts, however, the fact that there are millions of Linux systems incapable of receiving updates reminds us how delicate a security flaw in the kernel can be.
Source: Ars Technica
Official site: dirtycow.ninja
