Vulnerability Spotlight: Dirty Pipe
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… | |
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available. Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root. | 7.8 | 90% | KEV PoC ×4 |
| mass≈1 billion+ Linux-based systems (servers, cloud VMs, Android/embedded devices) potentially vulnerable on unpatched kernels |
Full article717 words · extracted from recordedfuture.com · click to collapse
Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.
This report provides an overview, technical analysis, and mitigations for CVE-2022-0847. Sources include the Recorded Future® Platform, GitHub, and open-source reporting. The intended audience for this report is defenders and analysts who are interested in how CVE-2022-0847 exploits work, as well as current mitigations that can be employed.
Executive Summary
CVE-2022-0847 (Dirty Pipe) is a Linux kernel vulnerability that was disclosed in early March 2022. The vulnerability was introduced in Linux kernel version 5.8 and allows for local privilege escalation via arbitrary file overwrites. An example proof-of-concept (POC) exploit was released with the disclosure, and since then several other POCs have been published on GitHub. The public exploits are reliable and only require a small number of prerequisites to work, such as having read permissions to a targeted file. Given the nature of this vulnerability, there are many different files that can be targeted for privilege escalation; therefore, this report highlights the techniques used by existing POC exploits. CVE-2022-0847 was patched in Linux kernel versions 5.16.11, 5.15.25, and 5.10.102, and all major Linux-based distributions have incorporated patches into their package repositories. Organizations should apply the recommended patches as soon as possible.
Key Observations
- CVE-2022-0847 existed in the wild for roughly 2 years, although there is no evidence that it was exploited prior to its public disclosure.
- Multiple POC exploits are publicly available, making this vulnerability easy to exploit and accessible to unsophisticated attackers.
- Exploits for CVE-2022-0847 are reliable and allow an attacker to gain root access when run on a vulnerable system. The root access enables the threat actor to perform administrative tasks such as reading sensitive files, installing malicious software, impersonating users, and potentially moving laterally throughout the network.
- The only mitigation for CVE-2022-0847 is to apply security patches, which are available for all major Linux distributions.
- Recorded Future has observed over 90 underground forum references to CVE-2022-0847 since it was disclosed, illustrating a general interest and potential intent to exploit the vulnerability in future campaigns.
Background
CVE-2022-0847 is a privilege escalation vulnerability in the Linux kernel that allows arbitrary files to be overwritten if the attacker has read access to the file. The vulnerability was introduced into the Linux kernel in version 5.8 and existed for roughly 2 years before being discovered and patched. It was discovered by Max Kellermann, who gave it the nickname “Dirty Pipe” due to its similarities with CVE-2016-5195 (aka “Dirty Cow”). Kellermann identified the vulnerability on February 19, 2022, and initiated a coordinated vulnerability disclosure the following day by submitting a bug report, POC exploit, and patch to the Linux kernel security team. Once patches were in place, the vulnerability was publicly disclosed on March 7, 2022. At this time, there is no evidence that CVE-2022-0847 was exploited in the wild prior to its disclosure.
The bug itself is rated high (7.8) on the CVSS 3.0 scale. Given the widespread nature of Linux-based operating systems (OS), the vulnerability affects many devices other than just desktops and servers running Linux-based OSes. Vulnerable devices include a wide range of internet of things (IoT) devices, routers, and Android tablets and phones. It is not possible to remotely exploit the vulnerability; however, it could be chained with a remote code execution (RCE) vulnerability to be used without local access. Additionally, not all devices will be vulnerable as Linux kernel versions prior to 5.8 are not affected, as well as any kernel versions that have been updated to the patched versions.
In a search of underground and dark web sources, we identified numerous discussions pertaining to CVE-2022-0847. While it is uncommon for threat actors to publicly disclose their intentions of targeting specific organizations using a particular CVE, a general interest shared by dark web forum members indicates threat actors’ intent to use CVE-2022-0847 in malicious campaigns. We identified 120 references to CVE-2022-0847 across multiple dark web forums over the past 2 months, as shown in Figure 1 below.
Figure 1: References for CVE-2022-0847 or Dirty Pipe on dark web forums (Source: Recorded Future)
Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.recordedfuture.com/research/vulnerability-spotlight-dirty-pipe