Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDirty COW was a serious Linux local privilege-escalation vulnerability, not a remote, unauthenticated break-in. An attacker who already had a local account, shell, or code execution could race the kernel into writing through a read-only private memory mapping. Successful exploitation could turn a low-privilege account into root-level control, especially on shared servers and systems running untrusted workloads.
How severe was Dirty COW?
National Institute of Standards and Technology (NIST) assigned CVE-2016-5195 a CVSS 3.1 base score of 7.0 (High) in 2016. The score reflects a vulnerability that requires local access and low privileges but can have high confidentiality, integrity and availability impact.
As an Amazon Associate I earn from qualifying purchases.
In practical terms, Dirty COW was a force multiplier. It did not normally provide an attacker’s first foothold. Once an attacker was already able to run code locally, however, the flaw could defeat protections that should have prevented changes to protected memory or privileged files.
Free tools Windows power users keep installed
One-click scans. No signup required.
What an attacker could do
Escalate from a normal account to root
Linux uses copy-on-write (COW) so processes can share a physical memory page until one needs to modify it. A private read-only mapping should cause the kernel to create a separate writable copy when a write occurs. Dirty COW was a race condition in that breakage path. By repeatedly timing memory operations, an unprivileged process could sometimes make a write reach the underlying page or file despite its permissions.
#1 Best Overall
Red Hat described the consequence as an unprivileged local user gaining write access to otherwise read-only memory mappings and increasing privileges. Common exploit techniques targeted set-user-ID (setuid) programs or other privileged binaries. If the attack succeeded, the result could be root privileges, allowing the attacker to read secrets, alter system software, create accounts, disable security controls or disrupt availability.
Modify protected files indirectly
One documented strategy used madvise(MADV_DONTNEED) against an executable page that had been memory-mapped. The race could cause changes to the file-backed content even though ordinary file permissions denied the write. This is why the bug was more dangerous than a simple application crash: it could undermine the operating system’s privilege boundary.
Rank #2
What Dirty COW did not do
- It was not, by itself, a remote network intrusion. The attacker needed local access or code execution first.
- It did not automatically compromise every machine running Linux. Exposure depended on the kernel build and whether the vendor fix had been installed.
- It did not guarantee root access on every attempt. The exploit relied on a timing race, although working exploits were publicly demonstrated.
Red Hat summarized the prerequisite plainly: an attacker had to already have access to a server before exploiting the vulnerability. That makes a hardened, single-user workstation a different risk case from a multi-user host where several accounts or services execute untrusted code.
Was Dirty COW exploited in the wild?
Yes. NIST’s CVE record says the vulnerability was exploited in the wild in October 2016, and Red Hat reported that an exploit using the technique had been found in the wild. Those statements establish real-world exploitation, but the cited sources do not provide an authoritative total of compromised systems or victims. There is therefore no defensible victim-count figure to attach to Dirty COW.
Which systems were affected?
NIST described the upstream exposure as Linux kernel 2.x through versions before 4.8.3. Distribution kernels often backport security fixes without adopting the same upstream version number, so that range is not a reliable test for a current installation.
Red Hat listed RHEL 5, RHEL 6 and RHEL 7, along with Red Hat Enterprise MRG 2, OpenShift Online v2 and Red Hat Virtualization hosts, among affected products at the time. Other distributions issued their own advisories and package updates.
| Question | What determines the answer |
|---|---|
| Is the machine in the upstream version range? | Kernel lineage matters, but it is not conclusive because vendors backport fixes. |
| Is the running system vulnerable? | Check the distribution’s CVE advisory and the exact installed and running kernel package. |
| Is a newly installed fix active? | The host must be rebooted into the updated kernel. |
Who faced the greatest practical risk?
Shared and hosting servers
Multiple customer or user accounts increase the chance that an attacker can obtain the local foothold Dirty COW requires. A successful escalation could cross those account boundaries and reach the host operating system.
CI runners, build hosts and developer machines
Systems that compile or run code from pull requests, customers or other untrusted sources were higher-risk environments. Code execution that would normally be confined to a low-privilege account could become host-level control.
Containers and virtualized workloads
Dirty COW was a host-kernel issue. A vulnerable host running untrusted workloads deserved urgent attention even when individual containers appeared isolated; the precise escape path depended on the platform and available privileges, so container use was not a substitute for patching.
Single-user endpoints
A single-user desktop with no existing malware or local attacker had less exposure because the prerequisite foothold was absent. That did not make an unpatched system safe: malware or another vulnerability could supply the local execution Dirty COW needed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to fix Dirty COW
- Identify the vendor advisory. Use the operating system’s security bulletin for CVE-2016-5195 rather than relying only on the upstream 4.8.3 boundary.
- Install the vendor kernel update. Red Hat recorded fixes in RHEL 7.3 and update advisories for RHEL 5 through 7; equivalent package updates were issued by other distributions.
- Reboot the host. A package can be installed while the old kernel is still running. Confirm after reboot that the fixed kernel is active.
- Review the host if it was exposed. On systems that allowed untrusted local users or code, examine account activity, privileged-file changes, persistence mechanisms and other indicators of compromise.
What about temporary mitigations?
Before kernel fixes were available, Red Hat documented SystemTap and ptrace-based mitigations as stop-gaps. They were not equivalent to patching. A Red Hat Bugzilla comment warned that the ptrace mitigation disabled functionality used by debuggers and programs that inspect other processes, including some virus scanners, and might not mitigate the issue completely.
Use such measures only as emergency risk reduction under the distribution’s guidance. They can break legitimate operations while leaving uncertainty about coverage. The durable remedy is the vendor kernel update followed by a reboot.
How bad should you consider it today?
Dirty COW belongs in the “high-impact after initial compromise” category. Its local-access requirement lowers the chance of a random internet scan taking over an otherwise isolated machine, but its ability to cross from an ordinary account to root made it highly consequential on shared infrastructure and untrusted-execution platforms. Confirming exploitation in the wild makes the historical risk concrete; the absence of a reliable victim total means severity should be judged from the attack chain and affected host, not from an invented prevalence statistic.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
