3

Vulnerability CVE–2016–5195 deals with privilege escalation in Linux systems. As far as I can tell, this is by being able to gain write permissions where an attacker might only have read-only permissions.

But does this vulnerability also circumvent the secondary layer of protection made possible by the SE Linux security structure? That is, if something is marked as read-only by both the Linux Kernel and by the SE permission system, does Dirty COW still allow for write operations?

2

Short answer: SELinux cannot protect against the "Dirty Cow" exploit without SELinux implementing a proposed change and the kernel updated with this change.

In default installations (notably RedHat Linux), SELinux does not use user-level confinement. Users and their shells run unconfined, so they would be able to access /proc/self/mem and exploit the "Dirty Cow" privilege escalation attack.

In order for SELinux to block this, users would have to be confined in such a way as not to have access to /proc/self/mem.

However, SELinux does not provide security around the kernel's handling of memory, merely process' execution and use of it. SELinux largely applies security to the filesystem. In the case of the COW (copy on write) exploit, memory handled by the kernel is being exploited for privilege escalation; going around SELinux protections.

It is possible for SELinux to be changed to support protections on the /proc mem files, and this has been discussed in the SELinux mailing list..

  • Sounds like you meant to say "yes" here, not "no"? – Ajedi32 Oct 21 '16 at 21:05
  • @Ajedi32 thanks for the feedback, the TLDR was definitely ambiguous so I've clarified it without yes /nos :) – Herringbone Cat Oct 21 '16 at 21:26
  • Can SELinux change ptrace policies? If so, then you could have SELinux protect from the vulnerability. – forest Mar 17 '18 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.