Notes on CVE-2022
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available. Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root. | 7.8 | 90% | KEV PoC ×4 |
| mass≈1 billion+ Linux-based systems (servers, cloud VMs, Android/embedded devices) potentially vulnerable on unpatched kernels |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| md5 | c3662a101db6bd9edec35767c7b85741 | of CVE-2022-0847 exploits) ebc8f0556e031a0b1180cfdfe6bf6e03 c3662a101db6bd9edec35767c7b85741 Latest Webinars Reports Kaspersky researchers have discover |
| md5 | ebc8f0556e031a0b1180cfdfe6bf6e03 | threat actors. IOCs (MD5 hashes of CVE-2022-0847 exploits) ebc8f0556e031a0b1180cfdfe6bf6e03 c3662a101db6bd9edec35767c7b85741 Latest Webinars Reports Ka |
Full article478 words · extracted from securelist.com · click to collapse
Last week, security researcher Max Kellermann discovered a high severity vulnerability in the Linux kernel, which was assigned the designation CVE-2022-0847. It affects the Linux kernels from 5.8 through any version before 5.16.11, 5.15.25 and 5.10.102, and can be used for local privilege escalation. The vulnerability resides in the pipe tool, which is used for unidirectional communication between processes, so the researcher called it “Dirty Pipe”. Although the flaw is fixed in the latest Linux kernel versions, and, according to our data, there is no mass exploitation of this vulnerability at the moment, a detailed description and a working POC are available online, which increases the risk of this vulnerability being exploited by attackers.
Kaspersky products protect against attacks leveraging the Dirty Pipe vulnerability. The detection verdicts are:
- HEUR:Exploit.Linux.CVE-2022-0847.a
- HEUR:Exploit.Linux.CVE-2022-0847.b
- HEUR:Exploit.Linux.CVE-2022-0847.с
- HEUR:Exploit.Linux.CVE-2022-0847.gen
Dirty Pipe technical details
An unprivileged local user could use the Dirty Pipe flaw to write to pages in the page cache backed by read-only files and as such, escalate their privileges on the system. This vulnerability happens due to usage of partially uninitialized memory of the pipe buffer structure during its construction. A lack of zero initialization of the new structure’s member results in a stale value of flags, which can be abused by an attacker to gain write access to pages in the cache even if they originally were marked with a read-only attribute.
There are plenty of ways for attackers to gain the root privileges using this vulnerability, such as unauthorized creation of new cron jobs, SUID binary hijacking, /etc/passwd modification, and so on.
A working version of the Dirty Pipe exploit is already available on various security-related sites and repositories, so it can be used by attackers ITW.
Dirty Pipe mitigations
To ensure that your corporate infrastructure is protected against this and similar threats:
- Apply all relevant security updates once they are available. To patch CVE-2022-0847, update your Linux systems to versions 5.16.11, 5.15.25 and 5.10.102 or newer.
- Use a security solution that provides patch management and endpoint protection, such as Kaspersky Endpoint Security for Linux.
- Use the latest Threat Intelligence information to stay aware of actual TTPs used by threat actors.
IOCs (MD5 hashes of CVE-2022-0847 exploits)
ebc8f0556e031a0b1180cfdfe6bf6e03
c3662a101db6bd9edec35767c7b85741
Latest Webinars
Reports
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/cve-2022-0847-aka-dirty-pipe-vulnerability-in-linux-kernel/106088/