Dirty Pipe Linux flaw impacts most QNAP NAS devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available. Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root. | 7.8 | 90% | KEV PoC ×4 |
| mass≈1 billion+ Linux-based systems (servers, cloud VMs, Android/embedded devices) potentially vulnerable on unpatched kernels |
Full article466 words · extracted from securityaffairs.com · click to collapse
Taiwanese vendor QNAP warns most of its NAS devices are impacted by high severity Linux vulnerability dubbed ‘Dirty Pipe.’
Taiwanese hardware vendor QNAP warns most of its Network Attached Storage (NAS) devices are impacted by the recently discovered Linux vulnerability ‘Dirty Pipe.’
An attacker with local access can exploit the high-severity vulnerability Dirty Pipe to gain root privileges.
The Dirty Pipe flaw, tracked as CVE-2022-0847, was discovered by the security expert Max Kellermann that explained that it can allow local users to gain root privileges on all major distros.
Kellerman published technical details about the Dirty Pipe flaw along with a proof-of-concept (PoC) exploit that allows local users to overwrite any file contents in the page cache, even if the file is not permitted to be written, immutable or on a read-only mount. The vulnerability affects Linux Kernel 5.8 and later versions.
BleepingComputer reported a tweet published by the security researcher Phith0n who explained that it is possible to use the exploit to modify the /etc/passwd file to set the root user without a password. Using this trick a non-privileged user could execute the command ‘su root’ to gain access to the root account. The researcher Phith0n also published an updated version of the exploit that allows gaining root privileges by overwriting a SUID program like ./exp /usr/bin/su to drop a root shell at /tmp/sh and then executing the script.
QNAP reported that the following versions of QTS and QuTS hero are affected by the flaw:
- QTS 5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS
- QuTS hero h5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS
For a full list of the affected models, the company urges customers to check “Kernel Version 5.10.60” in the following link: https://www.qnap.com/go/release-notes/kernel and pointed out that QNAP NAS running QTS 4.x are not affected.
QNAP told its customers that is working on a software release to address the flaw in its NAS devices.
“A local privilege escalation vulnerability, also known as “dirty pipe”, has been reported to affect the Linux kernel on QNAP NAS running QTS 5.0.x and QuTS hero h5.0.x. If exploited, this vulnerability allows an unprivileged user to gain administrator privileges and inject malicious code.” reads the advisory published by the vendor. “QNAP is thoroughly investigating the vulnerability. We will release security updates and provide further information as soon as possible.
“Currently there is no mitigation available for this vulnerability. We recommend users to check back and install security updates as soon as they become available.” the company added.
Customers who have Internet-exposed NAS devices are recommended to disable the Port Forwarding function and disable the UPnP function.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, QNAP NAS)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/129076/hacking/qnap-nas-dirty-pipe.html