CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability
High · CVSS 7.8 (CVSS 3.1)KEV known exploitedEPSS 92.8%, 100th percentilePublished Updated Assigner: redhat
In CISA’s Known Exploited Vulnerabilities catalog: Linux Kernel Privilege Escalation Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply updates per vendor instructions.
Description
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · CWE-665
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
kernel
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html (opens in new tab)
- packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html (opens in new tab)
- packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html (opens in new tab)
- packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html (opens in new tab)
- bugzilla.redhat.com/show_bug.cgi (opens in new tab)
- cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf (opens in new tab)
- dirtypipe.cm4all.com (opens in new tab)
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015 (opens in new tab)
- security.netapp.com/advisory/ntap-20220325-0005/ (opens in new tab)
- www.suse.com/support/kb/doc/ (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)