PT-2022-1364 · Linux+11 · Linux Kernel+11
Max Kellermann
·
Published
2016-10-19
·
Updated
2026-03-11
·
CVE-2022-0847
CVSS v3.1
7.8
High
| AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux Kernel versions prior to 5.16.11
Linux Kernel versions prior to 5.15.25
Linux Kernel versions prior to 5.10.102
Linux Kernel versions 5.8 through 5.16.10
Linux Kernel versions 5.8 through 5.15.24
Linux Kernel versions 5.8 through 5.10.101
Description
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy page to iter pipe and push pipe functions in the Linux kernel, allowing an unprivileged local user to write to pages in the page cache backed by read-only files and escalate their privileges on the system. This issue, known as "Dirty Pipe," can be exploited to overwrite arbitrary data, including files that are normally read-only, and gain complete control of a system. The vulnerability can be used to modify or overwrite arbitrary read-only files, obtain an elevated shell, and potentially allow an attacker to take control of a vulnerable system. It has been observed being used in real-world attacks, including by the UTA0137 threat actor, to gain privileges escalation.
Recommendations
For Linux Kernel versions prior to 5.16.11, update to version 5.16.11 or later.
For Linux Kernel versions prior to 5.15.25, update to version 5.15.25 or later.
For Linux Kernel versions prior to 5.10.102, update to version 5.10.102 or later.
As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.
Exploit
Fix
RCE
LPE
Improper Preservation of Permissions
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linux Kernel
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node