Security Advisory 0026
Date: October 21st, 2016
Version: 1.0
| Revision | Date | Changes |
|---|---|---|
| 1.0 | October 21st, 2016 | Initial release |
Arista Products vulnerability report for CVE-2016-5195
On October 21st 2016, information was released about a security advisory for a race condition vulnerability in Linux kernel memory subsystem copy on write mechanism.
Arista Network's software products EOS and Cloud Vision Portal (CVP) are not exploitable by CVE-2016-5195 (Kernel Local Privilege Escalation).
Description:
The Linux kernel since version 2.6.22 contains a race condition in the way the copy on write mechanism is handled by the memory subsystem, which may be leveraged locally to gain root privileges. A local, unprivileged attacker can escalate privileges to root.
This security issue relies on the user being able to run a malicious application when logged onto the system. On a standard hardened system that disallows shell access, users are not able to run arbitrary applications, making this a non-issue within Arista products.
References:
https://access.redhat.com/security/cve/CVE-2016-5195
https://www.kb.cert.org/vuls/id/243144
For More Information:
If you require further assistance, or if you have any further questions regarding this security notice, please contact the Arista Networks Technical Assistance Center (TAC) by one of the following methods:
Open a Service Request:
By email: This email address is being protected from spambots. You need JavaScript enabled to view it.
By telephone: 408-547-5502
866-476-0000