Linux Kernel 2.x-4.x < 4.8.3 - Local Privilege Escalation via Dirty COW Race Condition
Title source: llmExploitation Summary
CVE-2016-5195 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022. EIP tracks 72 public exploits from researchers including FireFart, Gabriele Bonacini, Robin Verton.
AI-analyzed exploit summary This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to overwrite the /etc/passwd file, allowing privilege escalation by adding a new root user. It uses the ptrace_pokedata method to achieve a race condition and modify the file.
Description
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Exploits (72)
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to overwrite the /etc/passwd file, allowing privilege escalation by adding a new root user. It uses the ptrace_pokedata method to achieve a race condition and modify the file.
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to gain root privileges by modifying the /etc/passwd file via a race condition in the Linux kernel's memory management. It spawns a root shell with a predefined password.
This exploit leverages the DirtyCow vulnerability (CVE-2016-5195) to achieve local privilege escalation by racing the madvise system call with writes to /proc/self/mem, overwriting a SUID binary (e.g., /usr/bin/passwd) with a shellcode payload that spawns a root shell.
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to achieve local privilege escalation by racing the madvise(MADV_DONTNEED) system call while writing to /proc/self/mem, allowing an attacker to overwrite read-only files.
This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to perform a race condition attack between madvise and ptrace system calls, allowing local privilege escalation by overwriting read-only files.
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation on vulnerable Android devices. The exploit leverages the race condition in the Linux kernel's memory management to overwrite read-only files, achieving root access.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings. The exploit modifies the /etc/passwd file to create a new root user with a specified password, demonstrating a local privilege escalation (LPE) attack.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), targeting the vDSO (virtual Dynamic Shared Object) to achieve local privilege escalation. The exploit uses a race condition in the Linux kernel's memory management to overwrite read-only memory mappings, specifically hijacking the `clock_gettime` function to execute arbitrary code.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies the /etc/passwd file to grant root access with a predefined password, and includes both C++ and Golang implementations.
This repository contains a proof-of-concept exploit for CVE-2022-0847 (Dirty Pipe), which allows overwriting any file contents in the page cache, even if the file is read-only or immutable. The exploit demonstrates privilege escalation by modifying the /etc/passwd file to gain root access without a password.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW) targeting 64-bit Android 6.0.1 Marshmallow. The exploit leverages the Dirty COW vulnerability to achieve local privilege escalation (LPE) by modifying the vDSO region in memory, bypassing SELinux, and providing a stable root shell without modifying the filesystem.
The repository claims to provide a precompiled exploit for CVE-2016-5195 (DirtyCow) but only contains a README with a link to an external blog post. No actual exploit code or technical details are included.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. The PoC patches the `getuid` and `geteuid` functions in libc to return 0, effectively bypassing privilege checks on CyanogenMod devices.
This repository contains a bash script that scans for the presence of vulnerable kernel versions affected by CVE-2016-5195 (Dirty Cow). It checks the current kernel version against a hardcoded list of known vulnerable versions and reports whether the system is vulnerable, mitigated, or safe.
This repository contains a Crystal language implementation of the Dirty COW (CVE-2016-5195) exploit, which leverages a race condition in the Linux kernel's memory subsystem to achieve local privilege escalation. The exploit allows writing to read-only memory mappings, enabling an attacker to modify critical system files.
This repository contains an Ansible role that mitigates CVE-2016-5195 (Dirty COW) by deploying a SystemTap module to patch the vulnerability. It includes tasks to check for the module, install dependencies, generate and load the module, and clean up afterward.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. The exploit modifies the /etc/passwd file to create a new root user with a specified password, leveraging a race condition in the kernel's memory handling.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), specifically targeting the vDSO (virtual Dynamic Shared Object) to achieve local privilege escalation. The exploit leverages a race condition in the Linux kernel's memory management to overwrite read-only memory mappings.
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The provided PoC demonstrates the race condition between madvise and write operations to achieve local privilege escalation.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies the /etc/passwd file to create a new root user with a specified password, leveraging a race condition in the kernel's memory management.
This repository contains a functional exploit PoC for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The code demonstrates the race condition between the `madvise` and `write` system calls to achieve arbitrary write access to read-only memory mappings.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. It includes an Ansible playbook to automate the compilation and execution of the exploit, which leverages a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a race condition vulnerability in the Linux kernel's copy-on-write mechanism. The exploit overwrites a SUID binary (e.g., /bin/ping) with shellcode to achieve root privilege escalation.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), specifically designed for Android devices. It includes a tool to replace files using the Dirty COW vulnerability, with a focus on educational and testing purposes.
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. It includes a proof-of-concept for arbitrary file writes and two exploits for gaining root access via /etc/passwd manipulation or SUID binary overwriting.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition in the copy-on-write mechanism to gain root access by overwriting a SUID binary.
This repository contains an incomplete Android APK project based on CVE-2016-5195 (DirtyCOW) but lacks functional exploit code. The README explicitly states it is non-working and under development.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The code includes native C implementations of the exploit (dirtycow.c) and a C# wrapper for executing the exploit via ADB on Android devices.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses race conditions between madvise and /proc/self/mem writes to overwrite the getuid function in libc, achieving root privileges.
This is a functional exploit for CVE-2016-5195 (Dirty COW), a race condition in the Linux kernel's memory subsystem. It uses concurrent threads to trigger a race between madvise(MADV_DONTNEED) and write operations to gain write access to read-only memory mappings, allowing privilege escalation by modifying /etc/passwd.
This repository contains a functional Go implementation of the Dirty COW (CVE-2016-5195) exploit, which leverages a race condition in the Linux kernel's memory subsystem to achieve local privilege escalation. The exploit overwrites the SUID binary `/usr/bin/passwd` with a payload that spawns a root shell.
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (DirtyCOW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings, allowing an attacker to modify files they would otherwise not have permission to write to.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating a local privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings, allowing an attacker to overwrite files and escalate privileges.
This repository contains a script to detect the presence of the Dirty COW vulnerability (CVE-2016-5195) by checking the kernel version against a list of known vulnerable versions. It does not include an exploit but provides a mitigation status check.
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to gain root access by overwriting the SUID binary `/usr/bin/passwd`.
The repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating a race condition in the Linux kernel's memory management subsystem to achieve local privilege escalation by modifying read-only files.
This repository documents a firmware reverse engineering project on an IoT camera, identifying multiple vulnerabilities including CVE-2016-5195 (DirtyCOW). It provides a detailed technical analysis of the vulnerabilities, tools used, and mitigation recommendations.
This repository provides a conceptual overview of the Dirty COW (CVE-2016-5195) kernel exploit, describing a realistic privilege escalation scenario. However, it lacks actual exploit code or technical deep-dive details.
This repository provides a detailed technical writeup on mitigating CVE-2016-5195 (Dirty Cow), including patching instructions, temporary fixes using systemtap, and testing methods. It does not contain exploit code but offers in-depth guidance on protection and verification.
This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), including multiple variants targeting /etc/crontab, /etc/passwd, and other files. The exploits leverage the race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings.
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), a Linux privilege escalation vulnerability. The exploit demonstrates the race condition in the copy-on-write mechanism but lacks post-exploit steps to prevent kernel crashes due to writeback.
This repository provides a detailed writeup of a privilege escalation exploit using CVE-2016-5195 (Dirty COW) on Ubuntu 16.04. It includes high-level steps, proof of execution, and screenshots but does not contain actual exploit code.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. The exploit modifies the /etc/passwd file to create a new root user by leveraging a race condition in the kernel's memory handling.
This repository provides a detailed technical walkthrough of exploiting CVE-2016-5195 (Dirty COW) for local privilege escalation on Metasploitable2, including step-by-step commands, troubleshooting, and validation steps.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation by modifying /etc/passwd to insert a root user with a known password. The exploit uses a race condition in the Linux kernel's memory management to achieve write access to read-only memory mappings.
This repository provides a detailed technical analysis of CVE-2016-5195 (Dirty Cow), including the root cause, exploitation steps, and mitigation strategies. It includes screenshots and references to external PoC exploits but does not contain functional exploit code itself.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to modify read-only files, potentially allowing local privilege escalation.
This repository provides a detailed writeup on exploiting CVE-2016-5195 (Dirty Cow), a Linux kernel vulnerability allowing local privilege escalation via a race condition. It includes steps for verification, compilation, and execution but lacks actual exploit code.
This repository contains a functional exploit for CVE-2016-5195 (DirtyCOW), demonstrating a race condition in the Linux kernel's memory management that allows privilege escalation by writing to read-only files. The PoC includes a detailed technical analysis of the exploit mechanism and kernel internals.
The repository contains only a README.md file with minimal information about CVE-2016-5195 (Dirty COW) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.
This repository contains functional exploit code for CVE-2016-5195 (DirtyCOW), a Linux kernel privilege escalation vulnerability. It includes multiple PoC exploits (e.g., cowroot.c, dirtycow-mem.c) and detection scripts for various distributions.
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. It includes compiled binaries and scripts to demonstrate privilege escalation by overwriting the 'run-as' binary to gain root access.
This repository provides a detailed technical analysis of CVE-2016-5195 (Dirty Cow), explaining the race condition vulnerability in Linux kernel memory management and how it can be exploited for local privilege escalation. It includes a conceptual exploit code example and a walkthrough of the attack mechanism.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings. The exploit modifies the /etc/passwd file to create a new user with root privileges.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition between madvise and procselfmem to gain write access to read-only memory mappings, allowing local users to escalate privileges.
The repository contains only a README file with a brief mention of CVE-2016-5195 (Dirty COW) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.
The repository contains no exploit code or technical details, only a vague description of exploiting CVE-2016-5195 (Dirty COW) for root access. It appears to be a placeholder or academic project summary without actionable content.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition between `madvise` and `proc/self/mem` to gain write access to read-only memory mappings, allowing an attacker to modify `/etc/group` and escalate privileges to root.
The repository contains only a README with a brief description of CVE-2016-5195 (Dirty Cow) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.
The repository contains only a README.md file with a title and no substantive content or exploit code. It appears to be a placeholder or incomplete repository.
This repository provides a detailed technical writeup on mitigating CVE-2016-5195 (Dirty Cow), including patching instructions, temporary fixes using systemtap, and testing methods. It does not contain exploit code but offers in-depth guidance on protection and verification.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition to overwrite a read-only SUID executable with a custom ELF payload. The payload elevates privileges via setuid(0), modifies kernel parameters to prevent crashes, and spawns a root shell.
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation on vulnerable Android devices via ADB. The exploit leverages the race condition in the Linux kernel's memory subsystem to overwrite read-only memory mappings, allowing arbitrary code execution as root.
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. It includes compiled binaries and scripts to demonstrate privilege escalation by overwriting the 'run-as' binary to gain root access.
This repository contains an Inspec profile for detecting CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. It downloads and compiles a known exploit script to test for vulnerability by attempting to modify a read-only file.
This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), a race condition vulnerability in the Linux kernel's Copy-on-Write mechanism. The exploit leverages a race between madvise and /proc/self/mem writes to achieve local privilege escalation.
This repository provides an Ansible playbook for mitigating CVE-2016-5195 (Dirty COW) on CentOS/Scientific Linux systems using SystemTap. It automates the installation of kernel debuginfo packages and SystemTap, then deploys a SystemTap module to mitigate the vulnerability.
This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit manipulates the /etc/passwd file to gain root access by leveraging a race condition in the copy-on-write mechanism.
This repository contains functional exploit code for CVE-2016-5195 (DirtyCOW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies /etc/passwd to create a new user with root privileges using race conditions between ptrace and /proc/self/mem.
This repository contains a functional exploit for CVE-2016-5195 (DirtyCow), a privilege escalation vulnerability in the Linux kernel. The exploit uses PTRACE_POKEDATA to overwrite a SUID binary with shellcode, granting root access. The code is well-documented and includes both x86 and x64 payloads.
The repository claims to be a reverse shell generator but lacks actual exploit code for CVE-2026-5195. It contains a web-based tool for generating reverse shells, which is unrelated to the specified CVE.
References (128)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H