CVE-2022-0847
Linux Kernel Privilege Escalation Vulnerability
Description
CVE-2022-0847, known as the "Dirty Pipe" vulnerability, is an improper initialization flaw in the Linux kernel that allows an unprivileged local user to escalate their privileges to root. The vulnerability exists in the pipe buffer handling mechanism of the Linux kernel, where a missing initialization of the flags member in a newly allocated pipe buffer structure allows an attacker to overwrite data in arbitrary cached read-only files, including SUID binaries. CISA has added CVE-2022-0847 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022, confirming active exploitation in the wild. The EPSS percentile of approximately 99.3% indicates near-certain exploitation activity, reflecting the trivial exploitability and widespread impact of Dirty Pipe across Linux systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 5.8, < 5.10.102; >= 5.15, < 5.15.25; >= 5.16, < 5.16.11 |
| fedoraproject | fedora | 35 |
| redhat | enterprise linux | 8.0 |
| redhat | enterprise linux eus | 8.2; 8.4 |
| redhat | enterprise linux for ibm z systems | 8.0 |
| redhat | enterprise linux for ibm z systems eus | 8.2; 8.4 |
| redhat | enterprise linux for power little endian | 8.0 |
| redhat | enterprise linux for power little endian eus | 8.2; 8.4 |
| redhat | enterprise linux for real time | 8 |
| redhat | enterprise linux for real time for nfv | 8 |
| redhat | enterprise linux for real time for nfv tus | 8.2; 8.4 |
| redhat | enterprise linux for real time tus | 8.2; 8.4 |
| redhat | enterprise linux server aus | 8.2; 8.4 |
| redhat | enterprise linux server for power little endian update services for sap solutions | 8.1; 8.2; 8.4 |
| redhat | enterprise linux server tus | 8.2; 8.4 |
| redhat | enterprise linux server update services for sap solutions | 8.1; 8.2; 8.4 |
| redhat | codeready linux builder | - |
| redhat | virtualization host | 4.0 |
| ovirt | ovirt-engine | 4.4.10.2 |
| netapp | h300s firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html(Third Party Advisory, VDB Entry)
- https://bugzilla.redhat.com/show_bug.cgi?id=2060795(Issue Tracking, Patch, Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf(Third Party Advisory)
- https://dirtypipe.cm4all.com/(Exploit, Third Party Advisory)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20220325-0005/(Third Party Advisory)
- https://www.suse.com/support/kb/doc/?id=000020603(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0847(US Government Resource)
Weakness Type
CWE-665: Improper Initialization
The Dirty Pipe vulnerability in the Linux kernel is caused by improper initialization of a pipe buffer's flags field. When a new pipe buffer page is allocated, the PIPE_BUF_FLAG_CAN_MERGE flag is not cleared, retaining the flag from a previous use of the same page. This allows an attacker to write data into pages in the page cache that belong to read-only files, bypassing all file permission checks and enabling arbitrary privilege escalation.
Learn more: CWE-665 — Improper Initialization
Impact Analysis
CVE-2022-0847 is a local privilege escalation vulnerability that requires an attacker to have unprivileged access to a Linux system but requires no special privileges or user interaction to exploit. The Dirty Pipe vulnerability allows any local user to overwrite arbitrary cached read-only files in the page cache, which can be leveraged to modify SUID binaries, inject code into running processes, or directly overwrite critical system files such as /etc/passwd to gain root access. The impact on confidentiality, integrity, and availability is severe: an attacker with root access can read all data on the system, modify any file or configuration, and disrupt any service or process. The EPSS percentile of approximately 99.3% places Dirty Pipe among the most exploited Linux kernel vulnerabilities, and its simplicity of exploitation, requiring only a few lines of C code, makes it accessible to attackers of all skill levels.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-0847 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 99.3% indicates near-certain exploitation activity, making Dirty Pipe one of the most actively exploited Linux kernel vulnerabilities in recent years. Multiple public proof-of-concept exploits have been available since the initial disclosure, with the original researcher publishing a clean, reliable exploit that demonstrates privilege escalation in seconds. The trivial nature of exploitation, combined with the widespread deployment of vulnerable Linux kernel versions (5.8 and later), has made CVE-2022-0847 a staple in attacker toolkits for Linux post-exploitation.
Remediation
-
Update the Linux kernel immediately to version 5.16.11, 5.15.25, or 5.10.102 or later, as directed by CISA: "Apply updates per vendor instructions." Apply vendor-specific kernel updates for your Linux distribution (Ubuntu, RHEL, Debian, SUSE, etc.) that backport the Dirty Pipe fix.
-
Prioritize patching for container hosts and cloud infrastructure running Linux kernel versions 5.8 through 5.16.10, as Dirty Pipe can be exploited from within containers to escape to the host system if the container shares the host kernel. Verify kernel versions across all container orchestration nodes.
-
Audit systems for indicators of compromise by checking for unauthorized modifications to SUID binaries, changes to critical system files such as
/etc/passwdor/etc/shadow, and any evidence of privilege escalation from unprivileged user accounts. Review audit logs for unexpected file modifications. -
Implement kernel hardening measures as interim mitigations where immediate patching is not possible. Enable kernel lockdown mode, deploy SELinux or AppArmor in enforcing mode, and use seccomp profiles to restrict the system calls available to unprivileged processes and containers.
-
Deploy runtime security monitoring using tools that can detect pipe-based exploitation patterns, unexpected writes to read-only files, and privilege escalation from unprivileged user contexts. Implement host-based intrusion detection that monitors for Dirty Pipe exploitation signatures.
Technical Details
CVE-2022-0847 exploits an improper initialization flaw (CWE-665) in the Linux kernel's pipe subsystem, specifically in how pipe buffer flags are handled when splicing data from a file into a pipe. When a pipe buffer's page is consumed and a new page is allocated, the flags field of the pipe_buffer structure retains the PIPE_BUF_FLAG_CAN_MERGE flag from the previous buffer usage instead of being initialized to zero. An attacker can exploit this by first filling a pipe to set the merge flag on all pipe pages, then clearing the pipe buffer contents, and finally using the splice() system call to read from a target read-only file into the pipe, followed by writing attacker-controlled data that gets merged into the file's page cache entry. This page cache write bypasses all file permission checks because it occurs at the kernel level through the pipe merge operation rather than through the normal file write path, enabling an unprivileged user to modify any cached file on the system and achieve root access.
Frequently Asked Questions
Is CVE-2022-0847 being actively exploited?
Yes, CVE-2022-0847 (Dirty Pipe) is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 99.3% confirms near-certain exploitation, with multiple public exploits available since disclosure.
What products are affected by CVE-2022-0847?
CVE-2022-0847 affects Linux systems running kernel versions 5.8 through 5.16.10, 5.15.24, or 5.10.101. This includes all major Linux distributions (Ubuntu, RHEL, Debian, SUSE, etc.), container hosts, cloud instances, and any embedded devices running affected kernel versions.
How do I fix CVE-2022-0847?
Update the Linux kernel to version 5.16.11, 5.15.25, or 5.10.102 or later. Apply vendor-specific kernel updates for your Linux distribution. As an interim measure, enable kernel hardening features such as SELinux enforcing mode and restrict unprivileged user access.
How severe is CVE-2022-0847?
CVE-2022-0847 is an extremely severe vulnerability with an EPSS percentile of approximately 99.3%. Dirty Pipe enables any unprivileged local user to escalate to root privileges with a trivial exploit, making it one of the most impactful Linux kernel vulnerabilities discovered in recent years.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.