Title: EGI SVG/IRTF Advisory **UPDATE** [TLP:WHITE ] 'CRITICAL' Risk
CVE-2016-5195 Linux kernel privilege escalation
[EGI-SVG-CVE-2016-5195]
Date: 2016-10-20
Updated: 2016-10-23 (Wiki only), 2016-10-24, 2016-10-25 (wiki only),
2016-10-26, 2016-10-31 (wiki only)
Affected software and risk
==========================
CRITICAL risk vulnerability concerning Linux kernel
Package : Linux Kernel
CVE ID : CVE-2016-5195
A kernel vulnerability has been found concerning a race condition allowing an
unprivileged local user to gain write access to otherwise read only mappings
and increase their privilege in the system.
** UPDATE 31st October 2016 **
==============================
Patches are now available for RedHat Linux 5 and SL5 [R 14]
Note that sites should migrate from RedHat 5 if they have not done so already -
see [R 13]
** UPDATE 26th October 2016 **
==============================
Patches are now available for RedHat linux 7 [R 4], RedHat Linux 6 [R 8] and
their derivatives.
This includes Scientific Linux versions, SL7 [R 7] and SL6 [R 9] CERN
Scientific Linux [R 10], CentOS 6 [R 11] and CentOS 7 [R 12].
All affected sites should now update their kernels to a non-vulnerable version
(see component installation information below) and reboot the systems. This
includes sites which have put mitigations in place, as these mitigations have
an impact on some VO Workflows. Sites are thus highly encouraged to replace
their local mitigation with the new official kernel as soon as possible.
Sites which are in downtime should restore services using non-vulnerable
versions.
Sites which do not have updates, mitigation in place, or are in downtime by
2016-10-31 T 18:00 UTC and/or failing to respond to requests from the EGI CSIRT
team risk site suspension.
For sites which have gone into downtime due to CVE-2016-5195 the downtime will
not be counted considering availability statistics for unavailability between
2016-10-20 16:00 UTC and 2016-10-31 18:00 UTC.
** UPDATE 24th October 2016 **
==============================
Since the vulnerability was publicly announced last week, publicly available
exploits have emerged and are trivial to use to gain root on the affected
systems. Unlike the initial exploit, some exploits were reported to work with
RHEL5/6 systems (using 'PTRACE_POKEDATA') see [R 6]. At the time of writing,
there is still no official update from RedHat.
As a result, we urge EGI sites to take immediate actions to mitigate the
vulnerability from their systems or to declare a downtime (for details see
below) and close any public interfaces used by VOs or users. Such downtime will
not be counted for the availability of your site until 3 working days after a
patch is released and an advisory update is circulated.
Actions required/recommended (Previous from 24th October)
==========================================================
Sites running an OS where patches are available (currently Debian and Ubuntu)
are required to install the new version. Machines allowing unprivileged user
access, such as Grid Worker Nodes, should be prioritised.
Sites running an OS where patches are not available are required to deploy a
mitigation or to declare a downtime in GOC-DB with the words
'EGI-SVG-CVE-2016-5195, vulnerability handling in progress' and close their
site until a patch or mitigation is deployed. Machines allowing unprivileged
user access, such as Grid Worker Nodes or User Interfaces, should be
prioritised.
Sites failing to act and/or failing to respond to requests from the EGI CSIRT
team before 2016-10-27T15:00:00Z risk site suspension.
Known Mitigations
=================
The following mitigations are known to work on RedHat-based distributions:
- A system-tap module that disable /proc/self/mem and ptrace, the official
- RedHat mitigation,
https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13 (no reboot needed).
Please note that this compltely disable GDB:
* If you use Centos 7 or Scientific Linux CERN 6, CERN is providing
* pre-compiled modules:
https://cern.service-now.com/service-portal/view-outage.do?n=OTG0033700
* If you use Centos 6, Nikhef is providing a pre-compiled module:
https://software.nikhef.nl/experimental/cve_2016_5195/
* If you are using Scientific Linux 6 or other flavor, there is currently no
* known pre-compiled module, you can compile some yourself.
Examples available here:
https://gitlab.cern.ch/ComputerSecurity/cve_2016_5195/tree/master
- A kernel module that disable the 'madvise' system call, the main component of
- the vulnerability exploit.
CESNET provides an implementation of the module at
https://github.com/bodik/dirtyc0w/tree/master/nomadvise (no reboot needed)
- The upstream patch has been ported to the Centos 6 kernel, resulting in a non
- vulnerable kernel: http://rep.grid.kiae.ru/pub/cve-2016-5195/
Affected software details
=========================
All Linux distributions, see relevant OS providers.
More information
================
More information is available from RedHat [R 1]
This advisory will be updated when patches become available for more different
operating systems.
Component installation information
==================================
Sites running Debian should see [R 2]
Sites running Ubuntu should see [R 3]
Sites running RedHat should see [R 4]
Sites running Scientific Linux (SL) should see [R 5], [R 7], [R 9], [R 14]
Sites running Cern Scientific Linux (SLC) should see [R 10]
Sites running CentOS should see [R 11], [R 12]
Other information
=================
If any site is still running SL5 or it's derivatives, please be reminded that
you should have decommissioned SL5 by 30th April 2016. [R 13]
TLP and URL
===========
** WHITE information - Unlimited distribution - see
https://go.egi.eu/tlp for distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2016-5195
Minor updates may be made without re-distribution to the sites.
Credit
======
SVG was alerted to this vulnerability by Daniel Kouril
References
==========
[R 1] https://bugzilla.redhat.com/show_bug.cgi?id=1384344
[R 2] https://security-tracker.debian.org/tracker/CVE-2016-5195
[R 3] http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5195.html
[R 4] https://access.redhat.com/security/cve/CVE-2016-5195
[R 5] https://www.scientificlinux.org/
[R 6] https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
[R 7] https://www.scientificlinux.org/sl-errata/slsa-20162098-1/
[R 8] https://access.redhat.com/errata/RHSA-2016:2105
[R 9] https://www.scientificlinux.org/sl-errata/slsa-20162105-1/
[R 10] http://linux.web.cern.ch/linux/updates/updates-slc6.shtml
[R 11] https://lists.centos.org/pipermail/centos-announce/2016-October/022134.html
[R 12] https://lists.centos.org/pipermail/centos-announce/2016-October/022133.html
[R 13] https://wiki.egi.eu/wiki/SL5_retirement
[R 14] https://www.scientificlinux.org/sl-errata/slsa-20162124-1/
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of a vulnerability which is relevant to EGI you may
report it by e-mail to
report-vulnerability at egi.eu.
The EGI Software Vulnerability Group will take a look.
Timeline
========
Yyyy-mm-dd [EGI-SVG-CVE-2016-5195]
2016-10-20 SVG alerted to this issue by Daniel Kouril
2016-10-20 Investigation of vulnerability and relevance to EGI
2016-10-20 EGI SVG Risk Assessment completed
2016-10-20 IRTF/SVG agreed to issue an urgent heads up.
2016-10-20 'Heads up' sent to sites
2016-10-24 Update sent to sites, clarifying actions
2016-10-25 Patches for RedHat 7 and SL7 available
2016-10-26 Patches for RedHat 6 and SL6 available
2016-10-26 Patches for SLC 6, CentOS 6, CentOS 7 available.
2016-10-26 Advisory update sent to sites.
2016-10-31 Updates available for RedHat 5 and SL5.
2016-10-31 Wiki updated.