WaratekVRT Sign in

CVE-2016-5195

Severity7.0 High CVSS 3.1 3 scores
WeaknessCWE-362
Published10 Nov 2016
Updated17 Jun 2026

Description

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-03 · remediation due 2022-03-24 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 14 citations · 54 exploits · earliest 2016-10-18.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 61 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2016-10-19.
  • EPSS 84% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2016-5195 in VulnCheck (free account), which lists 9 more citations and 49 more exploit references not shown here.

EvidenceSourceDetailDate
Reported exploitation docs.google.com /spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit 2016-10-18
Reported exploitation cve.org /CVERecord?id=CVE-2016-5195 2016-11-10
Reported exploitation nvd.nist.gov /vuln/detail/cve-2016-5195 2017-10-11
Reported exploitation dl.acm.org /doi/pdf/10.1145/3465481.3465758 2021-08-17
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-03-03
Exploit reference VulnCheck XDB 26759f64e421 Exploit type: local 2016-10-21
Exploit reference VulnCheck XDB 277a1d4bf8a2 Exploit type: local 2016-10-21
Exploit reference VulnCheck XDB 26aa72694109 Exploit type: local 2016-10-22
Exploit reference VulnCheck XDB 0eca479a0f12 Exploit type: local 2016-10-23
Exploit reference VulnCheck XDB 0f54259ef0a3 Exploit type: local 2016-11-17
IndexArtifactStarsFirst seen
GitHub PoC CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android 1,023 2016-10-21
Exploit-DB Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method) 2016-11-28
GitHub PoC Dirty Cow exploit - CVE-2016-5195 931 2016-11-25
Exploit-DB Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method) 2016-11-27
GitHub PoC PoC for Dirty COW (CVE-2016-5195) 511 2016-10-22
Exploit-DB Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method) 2016-10-26
GitHub PoC A CVE-2016-5195 exploit example. 340 2016-10-23
Exploit-DB Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method) 2016-10-21
GitHub PoC CVE-2022-0847-DirtyPipe-Exploit CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞，可覆盖重写任意可读文件中的数据，从而可将普通权限的用户提升到特权 root。 CVE-2022-0847 的漏洞原理类似于 CVE-2016-5195 脏牛漏洞（Dirty Cow），但它更容易被利用。漏洞作者将此漏洞命名为“Dirty Pipe” 281 2022-03-07
Exploit-DB Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method) 2016-10-19

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.0 HIGH v3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.0 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 7.0 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.2 none AV:L/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2018 ↗ CPU 2018-Q3 Oracle Communications Applications / Platform (Kernel) (12.x)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Platform (Kernel) 12.x 12

Products and versions

18 products, 41 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 12.04 · 14.04 · 16.04 · 16.10
nvd debian debian linux generic 7.0 · 8.0
nvd fedoraproject fedora generic 23 · 24 · 25
nvd linux linux kernel generic ≥ 2.6.22 and ＜ 3.2.83 · ≥ 3.3 and ＜ 3.4.113 · ≥ 3.5 and ＜ 3.10.104 · ≥ 3.11 and ＜ 3.12.66 · ≥ 3.13 and ＜ 3.16.38 · ≥ 3.17 and ＜ 3.18.44 · ≥ 3.19 and ＜ 4.1.35 · ≥ 4.2 and ＜ 4.4.26 · ≥ 4.5 and ＜ 4.7.9 · ≥ 4.8 and ＜ 4.8.3
nvd netapp cloud backup generic any version
nvd netapp hci storage nodes generic any version
nvd netapp oncommand balance generic any version
nvd netapp oncommand performance manager generic any version
nvd netapp oncommand unified manager for clustered data ontap generic any version
nvd netapp ontap select deploy administration utility generic any version
nvd netapp snapprotect generic any version
nvd netapp solidfire generic any version
nvd paloaltonetworks pan-os generic ≥ 5.1 and ＜ 7.0.14 · ≥ 7.1.0 and ＜ 7.1.8
nvd redhat enterprise linux generic 5 · 6.0 · 7.0
nvd redhat enterprise linux aus generic 6.2 · 6.4 · 6.5
nvd redhat enterprise linux eus generic 6.6 · 6.7 · 7.1
nvd redhat enterprise linux long life generic 5.6 · 5.9
nvd redhat enterprise linux tus generic 6.5

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Products:** KERNEL, ORACLE COMMUNICATIONS APPLICATIONS

References

URLTags
http://fortiguard.com/advisory/FG-IR-16-063 Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 Issue Tracking, Patch, Vendor Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10770 Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10774 Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10807 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00034.html Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.html Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00036.html Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00038.html Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00039.html Mailing List

Timeline
VulnCheck KEV: earliest evidence2016-10-18Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Published2016-11-10By the CVE Program.
Added to CISA KEV2022-03-03Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-10-14Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.