← voltar
CVE-2022-0847

CVE-2022-0847

CVSS 7.8 HIGHEPSS 89.1%● KEVCWE-665
Em resumo

Uma falha no kernel Linux permite que usuários sem privilégios escrevam em arquivos somente leitura através de memória não inicializada em funções de pipe, possibilitando elevação de privilégios.

Detalhe técnico

A vulnerabilidade existe nas funções copy_page_to_iter_pipe e push_pipe, onde o membro 'flags' da estrutura de buffer de pipe não é devidamente inicializado, permitindo valores obsoletos persistirem. Um atacante local sem privilégios pode explorar isso para escrever dados arbitrários em páginas do page cache vinculadas a arquivos somente leitura, contornando controles de acesso e elevando privilégios.

Resumo gerado e traduzido por IA a partir da descrição oficial.
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · kernel
PoCs públicas encontradas — 117
githubgithub.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit★ 1128githubgithub.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits★ 724githubgithub.com/r1is/CVE-2022-0847★ 282githubgithub.com/Al1ex/CVE-2022-0847★ 90githubgithub.com/DataDog/dirtypipe-container-breakout-poc★ 77githubgithub.com/basharkey/CVE-2022-0847-dirty-pipe-checker★ 69githubgithub.com/ZZ-SOCMAP/CVE-2022-0847★ 58githubgithub.com/bbaranoff/CVE-2022-0847★ 50githubgithub.com/febinrev/dirtypipez-exploit★ 49githubgithub.com/knqyf263/CVE-2022-0847★ 46githubgithub.com/greenhandatsjtu/CVE-2022-0847-Container-Escape★ 37githubgithub.com/airbus-cert/dirtypipe-ebpf_detection★ 29githubgithub.com/chenaotian/CVE-2022-0847★ 24githubgithub.com/ahrixia/CVE_2022_0847★ 21githubgithub.com/breachnix/dirty-pipe-poc★ 15githubgithub.com/0xIronGoat/dirty-pipe★ 14githubgithub.com/LudovicPatho/CVE-2022-0847_dirty-pipe★ 10githubgithub.com/crusoe112/DirtyPipePython★ 9githubgithub.com/crowsec-edtech/Dirty-Pipe★ 9githubgithub.com/xndpxs/CVE-2022-0847★ 9githubgithub.com/h4ckm310n/CVE-2022-0847-eBPF★ 8githubgithub.com/rexpository/linux-privilege-escalation★ 8githubgithub.com/qwert419/linux-★ 7githubgithub.com/drapl0n/dirtypipe★ 7githubgithub.com/arttnba3/CVE-2022-0847★ 6githubgithub.com/4luc4rdr5290/CVE-2022-0847★ 6githubgithub.com/Mustafa1986/CVE-2022-0847-DirtyPipe-Exploit★ 6githubgithub.com/KianaBin/CVE-2022-0847-Container-Escape★ 5githubgithub.com/DanaEpp/pwncat_dirtypipe★ 4githubgithub.com/nanaao/dirtyPipe-automaticRoot★ 4githubgithub.com/eduquintanilha/CVE-2022-0847-DirtyPipe-Exploits★ 3githubgithub.com/EagleTube/CVE-2022-0847★ 3githubgithub.com/MrP1xel/CVE-2022-0847-dirty-pipe-kernel-checker★ 3githubgithub.com/Shotokhan/cve_2022_0847_shellcode★ 3githubgithub.com/bluedragonsecurity/Linux-Kernel-Dirty-Pipe-Exploitation-Logic-Bug-★ 3githubgithub.com/gyaansastra/CVE-2022-0847★ 3githubgithub.com/sa-infinity8888/Dirty-Pipe-CVE-2022-0847★ 3githubgithub.com/zzzchuu/Dirty-Pipe★ 2githubgithub.com/0xeremus/dirty-pipe-poc★ 2githubgithub.com/JlSakuya/CVE-2022-0847-container-escape★ 2githubgithub.com/byteReaper77/Dirty-Pipe★ 2githubgithub.com/mutur4/CVE-2022-0847★ 2githubgithub.com/dadhee/CVE-2022-0847_DirtyPipeExploit★ 2githubgithub.com/CYB3RK1D/CVE-2022-0847-POC★ 2githubgithub.com/jpts/CVE-2022-0847-DirtyPipe-Container-Breakout★ 2githubgithub.com/tmoneypenny/CVE-2022-0847★ 2githubgithub.com/cspshivam/CVE-2022-0847-dirty-pipe-exploit★ 2githubgithub.com/Gustavo-Nogueira/Dirty-Pipe-Exploits★ 2githubgithub.com/mhanief/dirtypipe★ 2githubgithub.com/puckiestyle/CVE-2022-0847★ 2githubgithub.com/VinuKalana/DirtyPipe-CVE-2022-0847★ 2githubgithub.com/ihenakaarachchi/debian11-dirty_pipe-patcher★ 2githubgithub.com/karanlvm/DirtyPipe-Exploit★ 2githubgithub.com/scopion/dirty-pipe★ 1githubgithub.com/pashayogi/DirtyPipe★ 1githubgithub.com/realbatuhan/dirtypipetester★ 1githubgithub.com/muhammad1596/CVE-2022-0847-dirty-pipe-checker★ 1githubgithub.com/mattlloyddavies/ps-lab-cve-2022-0847★ 1githubgithub.com/xiaoLvChen/CVE-2022-0847★ 1githubgithub.com/mrchucu1/CVE-2022-0847-Docker★ 1githubgithub.com/lucksec/CVE-2022-0847★ 1githubgithub.com/ITMarcin2211/CVE-2022-0847-DirtyPipe-Exploit★ 1githubgithub.com/b4dboy17/Dirty-Pipe-Oneshot★ 1githubgithub.com/joeymeech/CVE-2022-0847-Exploit-Implementation★ 1githubgithub.com/Mephierr/DirtyPipe_exploit★ 1githubgithub.com/ayushx007/CVE-2022-0847-dirty-pipe-checker★ 0githubgithub.com/si1ent-le/CVE-2022-0847★ 0githubgithub.com/bohr777/cve-2022-0847dirtypipe-exploit★ 0githubgithub.com/Greetdawn/CVE-2022-0847-DirtyPipe★ 0githubgithub.com/nanaao/Dirtypipe-exploit★ 0githubgithub.com/AyoubNajim/cve-2022-0847dirtypipe-exploit★ 0githubgithub.com/pentestblogin/pentestblog-CVE-2022-0847★ 0githubgithub.com/babyshen/CVE-2022-0847★ 0githubgithub.com/edsonjt81/CVE-2022-0847-Linux★ 0githubgithub.com/V0WKeep3r/CVE-2022-0847-DirtyPipe-Exploit★ 0githubgithub.com/osungjinwoo/CVE-2022-0847-Dirty-Pipe★ 0githubgithub.com/Greetdawn/CVE-2022-0847-DirtyPipe-★ 0githubgithub.com/githublihaha/DirtyPIPE-CVE-2022-0847★ 0githubgithub.com/stfnw/Debugging_Dirty_Pipe_CVE-2022-0847★ 0githubgithub.com/0xr1l3s/CVE-2022-0847★ 0githubgithub.com/tufanturhan/CVE-2022-0847-L-nux-PrivEsc★ 0githubgithub.com/CPT-Jack-A-Castle/CVE-2022-0847★ 0githubgithub.com/isaiahsimeone/COMP3320-VAPT★ 0githubgithub.com/jxpsx/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/notl0cal/dpipe★ 0githubgithub.com/edsonjt81/CVE-2022-0847-DirtyPipe-★ 0githubgithub.com/DataFox/CVE-2022-0847★ 0githubgithub.com/pmihsan/Dirty-Pipe-CVE-2022-0847★ 0githubgithub.com/ajith737/Dirty-Pipe-CVE-2022-0847-POCs★ 0githubgithub.com/orsuprasad/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/jonathanbest7/cve-2022-0847★ 0githubgithub.com/ayushx007/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/solomon12354/LockingGirl-----CVE-2022-0847-Dirty_Pipe_virus★ 0githubgithub.com/letsr00t/CVE-2022-0847★ 0githubgithub.com/xsxtw/CVE-2022-0847★ 0githubgithub.com/muhammad1596/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/aswanepo/DirtyPipe★ 0githubgithub.com/JustinYe377/CTF-CVE-2022-0847★ 0githubgithub.com/mithunmadhukuttan/Dirty-Pipe-Exploit★ 0githubgithub.com/SimoesCTT/Chrono-Drip-Temporal-Viscosity-Exploitation-Framework-CVE-2022-0847★ 0githubgithub.com/real-tim-johnston/megaquagga-pentest-report★ 0githubgithub.com/JeevanAnand1202/Penetration-Test★ 0githubgithub.com/gaganhm3018-art/CVE-2022-0847-Dirty-Pipe-★ 0githubgithub.com/t1ckprivate/CVE-2022-0847-Dirty-Pipe★ 0githubgithub.com/RogelioPumajulca/CVE-2022-0847★ 0githubgithub.com/cypherlobo/DirtyPipe-BSI★ 0githubgithub.com/morgenm/dirtypipe★ 0githubgithub.com/Scouserr/cve-2022-0847-poc-dockerimage★ 0githubgithub.com/Shadow-Spinner/CVE-2022-0847★ 0githubgithub.com/honeyvig/CVE-2022-0847-DirtyPipe-Exploit★ 0githubgithub.com/gladiator-07/CVE-2022-0847★ 0githubgithub.com/stfnw/reproducer-poc-CVE-2022-0847★ 0cve_referencepacketstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.htmlnão verificadocve_referencepacketstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.htmlnão verificadocve_referencepacketstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.htmlnão verificadocve_referencepacketstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.htmlnão verificadoexploitdbwww.exploit-db.com/exploits/50808não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=2060795https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdfhttps://dirtypipe.cm4all.com/https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015https://security.netapp.com/advisory/ntap-20220325-0005/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0847https://www.suse.com/support/kb/doc/?id=000020603