Is Cumulus Linux susceptible to the kernel vulnerability CVE-2016-5195?
- Cumulus Linux 2.5.0 and later
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. All the information we have so far is included in this page.
The bug has existed since around 2.6.22 (released in 2007) and was fixed in the Linux kernel on 18 October, 2016.
While Cumulus Linux is susceptible to this issue, it should not affect users because switches running Cumulus Linux and Cumulus RMP do not normally have untrusted users able to login to the switch. This bug cannot be exploited remotely.
Cumulus Linux and Cumulus RMP version 3.1.2 has been updated with a fix for this security advisory.