DirtyCred is a Linux kernel privilege escalation technique presented at Black Hat USA in 2022 by researcher Zhenpeng Lin and his team. It swaps a low-privileged kernel credential for a privileged one, so a local attacker gains higher rights. It has no CVE of its own. CVE-2022-0847 belongs to the related DirtyPipe flaw, not to DirtyCred.
What is DirtyCred?
A new Linux Kernel vulnerability called “DirtyCred” was disclosed at the Black Hat USA security conference in August 2022. The vulnerability, which is similar to the notorious DirtyPipe vulnerability (tracked as CVE-2022-0847; DirtyCred itself has no CVE of its own), was discovered by Ph.D. detected by student Zhenpeng Lin and his team.
How does the DirtyCred exploit work?
DirtyCred is a kernel exploit that replaces non-privileged kernel credentials with privileged ones to escalate privileges on vulnerable systems. Instead of overwriting any critical data area in the kernel stack, the vulnerability abuses the heap memory reuse mechanism to gain privileges. It can overwrite all files with reading permission. The vulnerability allows a local threat actor to crash the system or execute arbitrary code on the vulnerable system.
Is there a demo of DirtyCred?
Security researchers have posted a demo on their social media accounts showing how the DirtyCred vulnerability can be used to elevate the privileges of a low-privileged user on two different systems, such as Centos 8 and Ubuntu, using the same Exploit code with the DirtyPipe vulnerability.
This Thursday @BlackHatEvents , I will be presenting our research on a kernel exploitation method named #DirtyCred. With DirtyCred, you could write an #DirtyPipe liked exploit that works on different kernels and ARCHs without code changes. Check it out Black Hat USA 2022 briefings schedule pic.twitter.com/jdopannoBO
— Zhenpeng Lin (@Markak_) August 7, 2022
Is there a fix for DirtyCred?
At the time of writing, no updates to the DirtyCred exploit were available. The researchers’ repository also includes a defense folder. Security researchers recommend separating privileged credentials from non-privileged ones using virtual memory to prevent potential Cross-Cache attacks using the vulnerability.