Security Bulletin
Summary
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An attacker could exploit this vulnerability to gain write access to read-only memory mappings and elevated privileges on the system.
Vulnerability Details
CVEID: CVE-2016-5195
DESCRIPTION: Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by a race condition when handling the copy-on-write (COW) breakage of private read-only memory mappings by the memory subsystem. An attacker could exploit this vulnerability to gain write access to read-only memory mappings and elevated privileges on the system. Note: This vulnerability is known as the Dirty COW bug.
CVSS Base Score: 8.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118170 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
These products affected by this vulnerability:
· ProtecTIER Enterprise Edition (PID 5639-PTA) - TS7650G
· ProtecTIER Appliance Edition (PID 5639-PTB) - TS7650AP1
· ProtecTIER Entry Edition (PID 5639-PTC) - TS7610 / TS7620
· ProtecTIER Gateway for System Z (PID 5639-FPA)
The code versions impacted are 1.2.x, 2.4.x, 2.5.x, 3.1.x, 3.2.x, 3.3.x and 3.4.x
Remediation/Fixes
|
<Product | VRMF | APAR | Remediation/First Fix |
| ProtecTIER Enterprise Edition (PID 5639-PTA) - TS7650G | 3.3.x,
3.4.x | Contact support | |
| ProtecTIER Appliance Edition (PID 5639-PTB) - TS7650AP1 | 3.3.x, | Contact support | |
| ProtecTIER Entry Edition (PID 5639-PTC) | 3.3.x,
3.4.x | Contact support |
For releases 3.2.x, 3.1.x and below, IBM recommends upgrading to a fixed, supported version/release/platform of the product.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
None
Change History
<31 January 2017> Date released
<2 May 2017> Updated
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
16 February 2022
UID
ssg1S1009664