Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Dirty COW could let a malicious app gain root privileges on an Android device with a vulnerable Linux kernel, but ZNIU is documented as a 2017 malware campaign—not evidence of a current, widespread threat. Whether a particular phone was exposed depended on its kernel and security patches, not just its Android version. Install updates from the device maker and avoid untrusted app downloads.
What Dirty COW means for Android
Dirty COW is the common name for CVE-2016-5195, a race condition in the Linux kernel’s copy-on-write (COW) memory handling. COW lets processes share memory pages until one needs to change them. The flaw could allow a local, unprivileged user to write to a memory mapping that should be read-only and elevate privileges.
The National Vulnerability Database (NIST) describes affected Linux kernel versions as 2.x through versions before 4.8.3. It assigns the flaw a CVSS 3.1 base score of 7, rated High, and notes that it is included in CISA’s Known Exploited Vulnerabilities catalog. That broad Linux version description does not identify every affected Android phone: Android devices use vendor-specific kernels and updates.
Could Dirty COW root a phone?
Yes, on an affected and unpatched device, an app exploiting the flaw could gain elevated privileges, potentially including root. Google’s Android Security 2016 report describes Dirty COW as a Linux-kernel privilege-escalation flaw that made Android devices susceptible to rooting. It says exploitation required a user to download an app that used the loophole. This was not, by itself, a claim that simply visiting a website or receiving a message would root every Android phone.
#1 Best Overall
Root access is a privilege level, not proof that every device was compromised or that access would necessarily persist after a restart. The practical risk required a vulnerable kernel and an attacker’s code running locally, such as in a downloaded malicious app.
What ZNIU did—and what “reappears” means
Trend Micro reported in September 2017 that it had discovered ZNIU, detected as ANDROIDOS_ZNIU, as the first malware identified exploiting Dirty COW on Android. Its report described the malware’s Android delivery and exploitation of the kernel flaw. The campaign figures Trend Micro published at the time were at least 5,000 affected users in more than 40 countries, with the malware concealed in more than 1,200 malicious apps. Those are historical 2017 figures, not a current count.
The available reporting establishes a past ZNIU campaign; it does not establish that ZNIU is currently active at scale or that Dirty COW has newly returned as a broad Android threat. The word “reappears” should therefore be read as a reference to renewed attention to an old vulnerability and its malware history, not as confirmation of a current outbreak.
Which Android devices were named as vulnerable?
Google’s December 2016 Android security bulletin listed CVE-2016-5195 as a Critical upstream-kernel issue for the following devices. The bulletin’s list is specific to that update and should not be treated as a complete list of every Android model that could have been affected.
- Nexus 5X
- Nexus 6
- Nexus 6P
- Nexus 9
- Android One
- Pixel C
- Nexus Player
- Pixel
- Pixel XL
For an individual phone, check its security patch level and the manufacturer’s security notices. An Android version number alone cannot confirm whether the device’s kernel was affected or whether the relevant fix was applied.
Quick Recap
How to protect an Android phone
- Install available security updates. Use the device’s system update settings and follow the manufacturer’s update guidance. Check the displayed Android security patch level afterward, then consult the vendor’s bulletin if you need to confirm whether a particular fix applies.
- Use trusted app sources. Avoid sideloading apps from untrusted websites or links. An app had to run locally to exploit Dirty COW in the Android scenario described by Google.
- Consider support status. If the manufacturer no longer provides security updates, the phone may remain exposed to other unpatched flaws as well. Prefer a vendor-supported device for sensitive use rather than assuming that an old Android version has received every kernel fix.
- On Linux systems, patch the kernel. Red Hat recommends applying the vendor kernel update and rebooting so the updated kernel is running. Its advisory says fixes for affected RHEL products were included in RHEL 7.3. This guidance concerns Red Hat systems; follow the relevant Linux distributor’s instructions for other distributions.
What to do if you suspect compromise
- Remove apps you do not trust, especially ones installed outside an official store or obtained from an unfamiliar link.
- Back up essential personal data, taking care not to restore suspicious apps or files automatically.
- Install the latest update available for the device. If the manufacturer’s incident guidance recommends it, or the device remains suspect, factory-reset it and set it up again carefully.
- For sensitive accounts or a work-managed phone, contact the device maker, your organization’s security team, or a qualified mobile-security professional. An antivirus claim alone cannot establish that Dirty COW has been fixed at the kernel level.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
