|Main page||Software Security Checklist||Issue Handling||Advisories||Notes On Risk||Advisory Template||RAT/Membership||Documents||Assessment||Secure Coding||Info for SVG members|
Title: EGI SVG/IRTF Advisory **UPDATE** [TLP:WHITE ] 'CRITICAL' Risk CVE-2016-5195 Linux kernel privilege escalation [EGI-SVG-CVE-2016-5195] Date: 2016-10-20 Updated: 2016-10-23 (Wiki only), 2016-10-24, 2016-10-25 (wiki only), 2016-10-26, 2016-10-31 (wiki only) Affected software and risk ========================== CRITICAL risk vulnerability concerning Linux kernel Package : Linux Kernel CVE ID : CVE-2016-5195 A kernel vulnerability has been found concerning a race condition allowing an unprivileged local user to gain write access to otherwise read only mappings and increase their privilege in the system. ** UPDATE 31st October 2016 ** ============================== Patches are now available for RedHat Linux 5 and SL5 [R 14] Note that sites should migrate from RedHat 5 if they have not done so already - see [R 13] ** UPDATE 26th October 2016 ** ============================== Patches are now available for RedHat linux 7 [R 4], RedHat Linux 6 [R 8] and their derivatives. This includes Scientific Linux versions, SL7 [R 7] and SL6 [R 9] CERN Scientific Linux [R 10], CentOS 6 [R 11] and CentOS 7 [R 12]. All affected sites should now update their kernels to a non-vulnerable version (see component installation information below) and reboot the systems. This includes sites which have put mitigations in place, as these mitigations have an impact on some VO Workflows. Sites are thus highly encouraged to replace their local mitigation with the new official kernel as soon as possible. Sites which are in downtime should restore services using non-vulnerable versions. Sites which do not have updates, mitigation in place, or are in downtime by 2016-10-31 T 18:00 UTC and/or failing to respond to requests from the EGI CSIRT team risk site suspension. For sites which have gone into downtime due to CVE-2016-5195 the downtime will not be counted c onsidering availability statistics for unavailability between 2016-10-20 16:00 UTC and 2016-10-31 18:00 UTC. ** UPDATE 24th October 2016 ** ============================== Since the vulnerability was publicly announced last week, publicly available exploits have emerged and are trivial to use to gain root on the affected systems. Unlike the initial exploit, some exploits were reported to work with RHEL5/6 systems (using 'PTRACE_POKEDATA') see [R 6]. At the time of writing, there is still no official update from RedHat. As a result, we urge EGI sites to take immediate actions to mitigate the vulnerability from their systems or to declare a downtime (for details see below) and close any public interfaces used by VOs or users. Such downtime will not be counted for the availability of your site until 3 working days after a patch is released and an advisory update is circulated. Actions required/recommended (Previous from 24th October) ========================================================== Sites running an OS where patches are available (currently Debian and Ubuntu) are required to install the new version. Machines allowing unprivileged user access, such as Grid Worker Nodes, should be prioritised. Sites running an OS where patches are not available are required to deploy a mitigation or to declare a downtime in GOC-DB with the words 'EGI-SVG-CVE-2016-5195, vulnerability handling in progress' and close their site until a patch or mitigation is deployed. Machines allowing unprivileged user access, such as Grid Worker Nodes or User Interfaces, should be prioritised. Sites failing to act and/or failing to respond to requests from the EGI CSIRT team before 2016-10-27T15:00:00Z risk site suspension. Known Mitigations ================= The following mitigations are known to work on RedHat-based distributions: - A system-tap module that disable /proc/self/mem and ptrace, the official RedHat mitigation, https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13 (no reboot needed). Please note that this compltely disable GDB: * If you use Centos 7 or Scientific Linux CERN 6, CERN is providing pre-compiled modules: https://cern.service-now.com/service-portal/view-outage.do?n=OTG0033700 * If you use Centos 6, Nikhef is providing a pre-compiled module: https://software.nikhef.nl/experimental/cve_2016_5195/ * If you are using Scientific Linux 6 or other flavor, there is currently no known pre-compiled module, you can compile some yourself. Examples available here: https://gitlab.cern.ch/ComputerSecurity/cve_2016_5195/tree/master - A kernel module that disable the 'madvise' system call, the main component of the vulnerability exploit. CESNET provides an implementation of the module at https://github.com/bodik/dirtyc0w/tree/master/nomadvise (no reboot needed) - The upstream patch has been ported to the Centos 6 kernel, resulting in a non vulnerable kernel: http://rep.grid.kiae.ru/pub/cve-2016-5195/ Affected software details ========================= All Linux distributions, see relevant OS providers. More information ================ More information is available from RedHat [R 1] This advisory will be updated when patches become available for more different operating systems. Component installation information ================================== Sites running Debian should see [R 2] Sites running Ubuntu should see [R 3] Sites running RedHat should see [R 4] Sites running Scientific Linux (SL) should see [R 5], [R 7], [R 9], [R 14] Sites running Cern Scientific Linux (SLC) should see [R 10] Sites running CentOS should see [R 11], [R 12] Other information ================= If any site is still running SL5 or it's derivatives, please be reminded that you should have decommissioned SL5 by 30th April 2016. [R 13] TLP and URL =========== ** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions*** URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-CVE-2016-5195 Minor updates may be made without re-distribution to the sites. Credit ====== SVG was alerted to this vulnerability by Daniel Kouril References ========== [R 1] https://bugzilla.redhat.com/show_bug.cgi?id=1384344 [R 2] https://security-tracker.debian.org/tracker/CVE-2016-5195 [R 3] http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5195.html [R 4] https://access.redhat.com/security/cve/CVE-2016-5195 [R 5] https://www.scientificlinux.org/ [R 6] https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs [R 7] https://www.scientificlinux.org/sl-errata/slsa-20162098-1/ [R 8] https://access.redhat.com/errata/RHSA-2016:2105 [R 9] https://www.scientificlinux.org/sl-errata/slsa-20162105-1/ [R 10] http://linux.web.cern.ch/linux/updates/updates-slc6.shtml [R 11] https://lists.centos.org/pipermail/centos-announce/2016-October/022134.html [R 12] https://lists.centos.org/pipermail/centos-announce/2016-October/022133.html [R 13] https://wiki.egi.eu/wiki/SL5_retirement [R 14] https://www.scientificlinux.org/sl-errata/slsa-20162124-1/ Comments ======== Comments or questions should be sent to svg-rat at mailman.egi.eu If you find or become aware of a vulnerability which is relevant to EGI you may report it by e-mail to report-vulnerability at egi.eu. The EGI Software Vulnerability Group will take a look. Timeline ======== Yyyy-mm-dd [EGI-SVG-CVE-2016-5195] 2016-10-20 SVG alerted to this issue by Daniel Kouril 2016-10-20 Investigation of vulnerability and relevance to EGI 2016-10-20 EGI SVG Risk Assessment completed 2016-10-20 IRTF/SVG agreed to issue an urgent heads up. 2016-10-20 'Heads up' sent to sites 2016-10-24 Update sent to sites, clarifying actions 2016-10-25 Patches for RedHat 7 and SL7 available 2016-10-26 Patches for RedHat 6 and SL6 available 2016-10-26 Patches for SLC 6, CentOS 6, CentOS 7 available. 2016-10-26 Advisory update sent to sites. 2016-10-31 Updates available for RedHat 5 and SL5. 2016-10-31 Wiki updated.