search

timwr / CVE-2016-5195

CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android
959 stars 395 forks source link

how do I remove the run-as from /system/bin ? #13

Closed allgood closed 8 years ago

allgood commented 8 years ago

Tested to see if my phone is vulnerable, and now, how is the procedure to remove it from there?

Will the presence of it there result in problems with OTA updates?

Best regards, Claudemir

Apology11 commented 8 years ago

Just reboot your device and it will be back to normal

agkunkle commented 8 years ago

On this subject, can anyone explain how this exploit is able to write to pages that are backed by a file (in this case "/system/bin/run-as") on the "/system" partition which is mounted read-only?

Obviously it works pretty well (first time on my fully patched Nexus 5) - but how is that? Are the pages associated with the file data just being kept in a kernel page cache? If so, over time will it be likely that the exploited pages will be discarded from the page cache and reloaded from the backed file?

allgood commented 8 years ago

Just reboot your device and it will be back to normal

explained. thank you