Update on Dec 01, 2016:

Oracle has provided a solution for the "Dirty COW" (CVE-2016-5195) on Exadata - which is delivered as a complete patch

It is important to apply with the 161109 build date as there were earlier build dates for this release and they do not resolve the "Dirty COW" vulnerability.


Exadata release and patch (24441458) (Doc ID 2181366.1)




See Note 1270094.1 for additional fixes that address critical issues. 24441458 - Storage server and InfiniBand switch software (
Patch 24669306 - Database server bare metal / domU ULN exadata_dbserver_12. OL6 channel ISO image (
Patch 24669307 - Database server dom0 ULN exadata_dbserver_dom0_12. OVM3 channel ISO image (


Supplemental README Note 2181366.1 was updated from to to include important fixes.  See the fix list in patch 24441458 for details.


Original article below


Since almost all Exadata, Exalogic and ZDLRA machines in the  world are running on Oracle Linux they could be vulnerable to the CVE-2016-5195 which exploits access elevation during Copy On Write operations - hence the Dirty COW nickname.


This vulnerability became widely known in mid-October 2016 and according to the sources like Risk Assessment | Ars Technica UK  the current state of the appropriate patch development is as following:

"The underlying bug was patched this week by the maintainers of the official Linux kernel. Downstream distributors are in the process of releasing updates that incorporate the fix. Red Hat has classified the vulnerability as "important.""


The dangers of this vulnerability is also described on Risk Assessment | Ars Technica UK  as following

"As their names describe, privilege-escalation or privilege-elevation vulnerabilities allow attackers with only limited access to a targeted computer to gain much greater control. The exploits can be used against Web hosting providers that provide shell access, so that one customer can attack other customers or even service administrators. Privilege-escalation exploits can also be combined with attacks that target other vulnerabilities. A SQL injection weakness in a website, for instance, often allows attackers to run malicious code only as an untrusted user. Combined with an escalation exploit, however, such attacks can often achieve highly coveted root status."


Oracle has already categorized this vulnerability as of October 21, 2016 and RPMs that include the fix for this CVE have been released as well.

Please refer to this page to get up to the minute update (and the patched RPMs) for this vulnerability linux.oracle.com | CVE-2016-5195

Depending on your Exadata bundle patch level the Oracle Linux kernel version would either 6 (hopefully ) or 5, so please look for the appropriate errata links on the page above.


Update on 10/27:

The main page that tracks this vulnerability linux.oracle.com | CVE-2016-5195 is getting more updates pretty much daily now.

Updated RPMs that are mentioned there you could be found at https://oss.oracle.com/sources/  under the Oracle 5 or Oracle 6 links.


Additionally, for the current Exadata, Exalogic and ZDLRA patch levels , which assumes OEL 6, the following MOS document could be used as wellff


Oracle Linux 6: Reference Index of Security Vulnerability Bug fixes, CVE IDs and Oracle Linux Errata (Doc ID 2112930.1)


Customers may find status of fixes for CVEs for Oracle Linux through our Unbreakable Linux Network (ULN). Please refer to Oracle Support Document 1593465.1 "Unbreakable Linux Network (ULN) Administrative Features for Errata and CVEs"

This listing is sorted by the date of publication by Oracle.



Errata Date Component CVE ID Errata
25-Oct-2016Kernel-2.6.32CVE-2016-5195 (dirty COW)ELSA-2016-2105
21-Oct-2016Kernel-UEK-2.6.39CVE-2016-5195 (dirty COW)ELSA-2016-3634
21-Oct-2016Kernel-UEK-3.8.13CVE-2016-5195 (dirty COW)ELSA-2016-3633
21-Oct-2016Kernel-UEK-4.1.12CVE-2016-5195 (dirty COW)ELSA-2016-3632