VMware releases 'Dirty COW' patches

Virtualisation giant VMware has issued patches against the "Dirty COW" vulnerability discovered last month in the open source Linux kernel.

The flaw is caused by a bug in the Linux kernel's copy on write performance optimisation feature. It is easy to exploit for privilege escalation attacks, and is considered serious and actively abused by attackers.

Dirty COW has been around since September 2007, but has been patched in Linux kernels 4.4.26, 4.7.9, 4.8.3 and newer.

VMware said its Identity Manager tool for application provisioning, self-service catalogue, conditional access controls and single sign-on is affected by Dirty COW.

The vRealize Automation cloud management tool and the vRealize Operations management tool have also been flagged as subject to the bug.

VMware Operations versions 6.0.3, 6.1.0, 6.2.0a, 6.2.1, and 6.3.0 are being patched against Dirty COW.

However, the VMware Identity Manager 2.x, vRealize Automation 6.x, 7.x and Operations 5.x products are still waiting to receive patches.

No mitigations or workarounds for the Dirty COW vulnerability are available. VMware advised customers to patch against the flaw as soon as possible.