Dirty Pipe Exploit Rings Alarm Bells in the Linux Community
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available. Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root. | 7.8 | 90% | KEV PoC ×4 |
| mass≈1 billion+ Linux-based systems (servers, cloud VMs, Android/embedded devices) potentially vulnerable on unpatched kernels |
Full article407 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers are warning of a critical new vulnerability that could give root-level access to Linux systems, enabling remote attackers to perform a range of malicious actions.
The “Dirty Pipe” bug (CVE-2022-0847) is similar to the notorious Dirty Cow vulnerability discovered in 2016 but even easier to exploit, according to Max Kellermann, the researcher who found it last year.
The “pipe” in the moniker refers to the Linux pipeline, a mechanism for inter-process communication.
“To exploit this vulnerability, you need to: create a pipe; fill the pipe with arbitrary data (to set the PIPE_BUF_FLAG_CAN_MERGE flag in all ring entries); drain the pipe (leaving the flag set in all struct pipe_buffer instances on the struct pipe_inode_info ring); splice data from the target file (opened with O_RDONLY) into the pipe from just before the target offset; write arbitrary data into the pipe. This data will overwrite the cached file page instead of creating a new anomyous struct pipe_buffer because PIPE_BUF_FLAG_CAN_MERGE is set,” Kellermann explained.
“To make this vulnerability more interesting, it not only works without write permissions, it also works with immutable files, on read-only btrfs snapshots and on read-only mounts (including CD-ROM mounts). That is because the page cache is always writable (by the kernel), and writing to a pipe never checks any permissions.”
In effect, the vulnerability could allow attackers to overwrite files on a system, elevate privileges, move laterally inside networks and execute arbitrary code to hijack devices.
However, there are limitations. The attacker must have read permissions, and the “offset” must not be on a page boundary. Also, the write cannot cross a page boundary, and the file cannot be resized.
CVE-2022-0847 has been fixed in Linux 5.16.11, 5.15.25, and 5.10.102, with patches coming soon for major distributions.
“Any exploit that gives root level access to a Linux system is problematic. An attacker that gains root gains full control over the target system and may be able to leverage that control to reach other systems. The mitigating factor with this vulnerability is that it requires local access, which slightly lowers the risk,” said Vulcan Cyber senior technical engineer Mike Parkin.
“Escalating privileges to root (POSIX family) or admin (Windows) is often an attacker’s first priority when they gain access to a system, as it gives them full control of the target and can help them extend their foothold to other victims. That hasn’t changed for ages and is unlikely to change in the foreseeable future.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/dirty-pipe-exploit-rings-alarm/