Does Linux "Dirty COW" Exploit allow for privilege escalation with SE protections in place?

Question

Vulnerability CVE–2016–5195 deals with privilege escalation in Linux systems. As far as I can tell, this is by being able to gain write permissions where an attacker might only have read-only permissions.

But does this vulnerability also circumvent the secondary layer of protection made possible by the SE Linux security structure? That is, if something is marked as read-only by both the Linux Kernel and by the SE permission system, does Dirty COW still allow for write operations?

Answer 1

Short answer: SELinux cannot protect against the "Dirty Cow" exploit without SELinux implementing a proposed change and the kernel updated with this change.

In default installations (notably RedHat Linux), SELinux does not use user-level confinement. Users and their shells run unconfined, so they would be able to access /proc/self/mem and exploit the "Dirty Cow" privilege escalation attack.

In order for SELinux to block this, users would have to be confined in such a way as not to have access to /proc/self/mem.

However, SELinux does not provide security around the kernel's handling of memory, merely process' execution and use of it. SELinux largely applies security to the filesystem. In the case of the COW (copy on write) exploit, memory handled by the kernel is being exploited for privilege escalation; going around SELinux protections.

It is possible for SELinux to be changed to support protections on the /proc mem files, and this has been discussed in the SELinux mailing list..