Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-0847

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Published

2022-03-10T17:44:57.283

Last Modified

2025-04-08T18:12:53.563

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Primary
CWE-665
Type: Secondary
CWE-665
Type: Secondary
CWE-665

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	linux	linux_kernel	< 5.10.102	Yes
Operating System	linux	linux_kernel	< 5.15.25	Yes
Operating System	linux	linux_kernel	< 5.16.11	Yes
Operating System	fedoraproject	fedora	35	Yes
Operating System	redhat	enterprise_linux	8.0	Yes
Operating System	redhat	enterprise_linux_eus	8.2	Yes
Operating System	redhat	enterprise_linux_eus	8.4	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	8.0	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems_eus	8.2	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems_eus	8.4	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	8.0	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian_eus	8.2	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian_eus	8.4	Yes
Operating System	redhat	enterprise_linux_for_real_time	8	Yes
Operating System	redhat	enterprise_linux_for_real_time_for_nfv	8	Yes
Operating System	redhat	enterprise_linux_for_real_time_for_nfv_tus	8.2	Yes
Operating System	redhat	enterprise_linux_for_real_time_for_nfv_tus	8.4	Yes
Operating System	redhat	enterprise_linux_for_real_time_tus	8.2	Yes
Operating System	redhat	enterprise_linux_for_real_time_tus	8.4	Yes
Operating System	redhat	enterprise_linux_server_aus	8.2	Yes
Operating System	redhat	enterprise_linux_server_aus	8.4	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.1	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.2	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.4	Yes
Operating System	redhat	enterprise_linux_server_tus	8.2	Yes
Operating System	redhat	enterprise_linux_server_tus	8.4	Yes
Operating System	redhat	enterprise_linux_server_update_services_for_sap_solutions	8.1	Yes
Operating System	redhat	enterprise_linux_server_update_services_for_sap_solutions	8.2	Yes
Operating System	redhat	enterprise_linux_server_update_services_for_sap_solutions	8.4	Yes
Application	redhat	codeready_linux_builder	-	Yes
Operating System	redhat	enterprise_linux	8.0	No
Operating System	redhat	enterprise_linux_eus	8.2	No
Operating System	redhat	enterprise_linux_eus	8.4	No
Operating System	redhat	enterprise_linux_for_power_little_endian	8.0	No
Operating System	redhat	enterprise_linux_for_power_little_endian_eus	8.2	No
Operating System	redhat	enterprise_linux_for_power_little_endian_eus	8.4	No
Application	redhat	virtualization_host	4.0	Yes
Operating System	redhat	enterprise_linux	8.0	No
Application	ovirt	ovirt-engine	4.4.10.2	Yes
Operating System	netapp	h300s_firmware	-	Yes
Hardware	netapp	h300s	-	No
Operating System	netapp	h500s_firmware	-	Yes
Hardware	netapp	h500s	-	No
Operating System	netapp	h700s_firmware	-	Yes
Hardware	netapp	h700s	-	No
Operating System	netapp	h300e_firmware	-	Yes
Hardware	netapp	h300e	-	No
Operating System	netapp	h500e_firmware	-	Yes
Hardware	netapp	h500e	-	No
Operating System	netapp	h700e_firmware	-	Yes
Hardware	netapp	h700e	-	No
Operating System	netapp	h410s_firmware	-	Yes
Hardware	netapp	h410s	-	No
Operating System	netapp	h410c_firmware	-	Yes
Hardware	netapp	h410c	-	No
Operating System	siemens	scalance_lpe9403_firmware	< 2.0	Yes
Hardware	siemens	scalance_lpe9403	-	No
Operating System	sonicwall	sma1000_firmware	≤ 12.4.2-02044	Yes
Hardware	sonicwall	sma1000	-	No

References

http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=2060795 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf Third Party Advisory ([email protected])
https://dirtypipe.cm4all.com/ Exploit, Third Party Advisory ([email protected])
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015 Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20220325-0005/ Third Party Advisory ([email protected])
https://www.suse.com/support/kb/doc/?id=000020603 Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=2060795 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://dirtypipe.cm4all.com/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20220325-0005/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.suse.com/support/kb/doc/?id=000020603 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)