CVE-2016-5195: Dirty COW Linux Kernel Race Condition

Defensive research, non-weaponized validation, and patch analysis for CVE-2016-5195 (Dirty COW), a Linux kernel copy-on-write race condition that can allow a local user to modify data associated with a read-only mapping and gain elevated privileges.

Overview

Dirty COW is a race in the Linux kernel's handling of forced writes and copy-on-write (COW) mappings. A local user can race page invalidation against a write through /proc/self/mem. On an affected kernel, the race may cause data associated with a nominally read-only private mapping to be written back to the underlying file.

The public impact is local privilege escalation when an attacker can apply the primitive to a security-sensitive file. The vulnerability was exploited in the wild in October 2016. This repository does not automate that escalation path.

Repository Layout

Safe Validation Harness

The default harness is intentionally constrained:

• it accepts no target path and no attacker-controlled payload;
• it creates a mode-0600 temporary file and immediately unlinks it;
• it races only the still-open disposable inode;
• it makes no network connection and executes no command; and
• it reports a fixed benign marker.

Build

cc -std=c11 -Wall -Wextra -Wpedantic -Werror -O2 \
  poc.c -o dirtycow-safe -pthread

The lab-only exploit primitive can be built separately:

cc -std=c11 -Wall -Wextra -Wpedantic -Werror -O2 \
  exploit.c -o dirtycow-exploit -pthread

Run on an isolated Linux test system

./dirtycow-safe

Optional bounded iteration count:

./dirtycow-safe --iterations 5000000

Possible results:

• marker-observed: vulnerable behavior was observed on the disposable inode.
• marker-not-observed: inconclusive. A race not triggering does not prove that the kernel is fixed.
• exit 77: the required Linux /proc/self/mem interface is unavailable.

Do not use the PoC result as the primary patch-status check. Consult the kernel package advisory for the running distribution and verify that the patched kernel is active after reboot.

Exploit Primitive

exploit.c accepts an explicit file and replacement prefix and demonstrates the arbitrary-file write primitive on an affected kernel. It requires the literal --i-understand confirmation, applies bounded payload and iteration limits, and does not build a privilege-escalation payload.

The selected file may be permanently modified. Use it only in an isolated, disposable lab that you own or are explicitly authorized to test. The complete race and state-transition analysis is in ROOT_CAUSE.md.

Evidence

evidence/evidence.json records the source signatures observed in the official pre-fix and fixed Linux revisions, the warning-clean PoC build result, and the validation safety properties. evidence/validation.log provides a concise summary. The captured validation did not execute the race.

Remediation

Install the vendor-provided kernel update and reboot into the patched kernel. Do not decide exposure from the upstream version string alone: enterprise and distribution kernels commonly backport the fix without adopting the upstream version number. Containers use the host kernel, so remediation must cover the host.

See PATCH_ANALYSIS.md for the exact upstream change and VULNERABILITY_REPORT.md for validation guidance.

References

• NVD: CVE-2016-5195
• Linux upstream fix
• Linux 4.8.3 changelog
• CISA Known Exploited Vulnerabilities Catalog
• Red Hat CVE record

Use this material only on systems you own or are explicitly authorized to test.