You are here
Linux Kernel Privilege Escalation - Huge Dirty Cow
Submitted on 6. December 2017 - 13:56 by rischi.
Last update on 6. December 2017 - 14:20.
Last update on 6. December 2017 - 14:20.
IDs:
CVE-2017-1000405
Keywords:
dirty cow
Description:
A flaw was found in the patches used to fix the 'dirtycow' vulnerability (CVE-2016-5195) [1]. An attacker, able to run local code, can exploit a race condition in transparent huge pages to modify usually read-only huge pages.
Airlock WAF is not affected because the commit that introduced this issue was not backported to CentOS 6 or 7.
Resolution:
For all back-end systems running a Linux kernel we recommend to check whether the Linux distribution is affected. We recommend to patch affected systems since these systems typically rely on interactive unprivileged users or the risk of a remote command execution flaw in the system is non negligible.
Component:
Airlock
Airlock Vulnerability Status:
Does not affect Airlock
Back-end Vulnerability Status:
Back-ends may be vulnerable, see resolution