Kernel Local Privilege Escalation "Dirty COW" - CVE-2016-5195

HOW TO BUILD AND USE THE SYSTEMTAP WORKAROUND

The systemtap countermeasure involves creating a kernel module (like a driver) using a systemtap script that intercepts the vulnerable system call. It is used as a stopgap solution until a fixed kernel is booted into the affected machine. This solution does not require a reboot and applies to RHEL 5, 6 and 7.

It is not possible to make a module that applies to all kernels. Not even for a family (i.e., All RHEL5, 6 or 7). Each specific kernel version requires a .ko generated for that given kernel (uname -r).

REQUIREMENTS

In order to build the systemtap module, the following packages are required:

• systemtap-client
• systemtap-devel
• gcc (and dependencies)
• kernel-devel-`uname -r`
• kernel-debuginfo-`uname -r`
• kernel-debuginfo-common-`uname -r`

WARNING: The 'kernel' packages requires the same version as the running kernel. Downloading the latest version will prevent systemtap for working. Please download the exact running version.

WHERE DO I GET THE DEBUGINFOS

Please refer to KB https://access.redhat.com/solutions/9907

HOW DO I BUILD THE MODULE

1. After you installed the packages, create a file named dirtycow.stp with this content:

probe kernel.function("mem_write").call ? {
        $count = 0
}

probe syscall.ptrace {  // includes compat ptrace as well
        $request = 0xfff
}

probe begin {
        printk(0, "CVE-2016-5195 mitigation loaded")
}


probe end {
        printk(0, "CVE-2016-5195 mitigation unloaded")
}
										

2. Save the file. Compile it using this command:

# stap -g -p 4 -m dirtycow_`uname -r|tr -cd [:digit:]` dirtycow.stp
dirtycow_26183985.ko
											

In the above example, the .ko file has a number identifying its kernel version. In that case, it is 2.6.18-398.el5. This module can be used in other systems with this exact kernel version without having to install the debuginfo and development packages, needing only systemtap-runtime . Just copy the module file to the server with the same kernel version, install the systemtap-runtime package and proceed from the next step.

3. In order to load the module, run the command staprun -L <.ko file>. For example:

# staprun -L dirtycow_26183985.ko
												

4. Check if is it loaded:

# dmesg | grep CVE-2016-5195
CVE-2016-5195 mitigation loaded
													

5. To unload the module, reboot the system or run the "staprun -A dirtycow_26183985" command and interrupt it with Ctlr+C, as shown below:

# staprun -A dirtycow_26183985
^C
Message from syslogd@...
kernel:CVE-2016-5195 mitigation unloaded
														

IMPORTANT

• The module does not survive a boot: It is not reloaded after a system boot.
• After a reboot, the module must be manually loaded again.
• If the kernel is updated or changed, this module won't be loaded into the new kernel.
• If you booted into a different kernel without the fix, a new compatible module should be loaded.
• A corrected kernel does not need the module load.