Log in Request a demo

Security News

New Linux Kernel Vulnerability Detected Giving Threat Actors Root Access

A Linux kernel flaw, Dirty Pipe (CVE-2022-0847), lets local users overwrite read-only files and gain root. See CVSS 7.8, affected and fixed versions.

Updated 1 Min Read
weekly security newsletter 34 linux kernel

The Linux kernel flaw known as Dirty Pipe (CVE-2022-0847) lets a local user without admin rights overwrite read-only files and gain root on vulnerable systems. NVD rates it CVSS 3.1 7.8 (High). It affects kernels from 5.8 and is fixed in 5.16.11, 5.15.25 and 5.10.102, so affected systems should be updated.

What is the new Linux kernel vulnerability?

A security vulnerability has been detected in the Linux Kernel, allowing users without local privileges to gain root privileges on vulnerable systems. The vulnerability, called Dirty Pipe, is similar to the Dirty Cow vulnerability and has been fixed in Linux Kernel and Android Kernel. Affected Linux distributions are in the process of issuing security updates for the vulnerability.

Where is CVE-2022-0847 located?

The vulnerability tracked as CVE-2022-0847 is located in the struct pipe_buffer component of the Linux Kernel. It allows threat actors to overwrite data in read-only files and SUID Binary files to gain root access.

Which Linux kernel versions are fixed?

The vulnerability affecting Linux Kernel 5.8 and later has been fixed in Linux 5.16.11, 5.15.25, 5.10.102, and the latest Android Kernel. Users using vulnerable Linux and Android Kernel versions are advised to apply the released updates immediately.

Frequently Asked Questions.

What is CVE-2022-0847?

CVE-2022-0847, called Dirty Pipe, is a Linux kernel flaw where a flags member in the pipe buffer code is not initialized. It lets an unprivileged local user write to read-only file-backed pages and escalate privileges.

What is the CVSS score of CVE-2022-0847?

NVD lists CVSS 3.1 base score 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which Linux kernel versions are affected by Dirty Pipe?

NVD lists kernels from 5.8 before 5.10.102, 5.15 before 5.15.25 and 5.16 before 5.16.11. Updating to those releases or later fixes it.

How do attackers use a privilege escalation flaw like this?

MITRE ATT&CK describes exploitation for privilege escalation as adversaries using software vulnerabilities to move from lower to higher permission levels, often reaching system or root access.

Sources

  1. 1 NVD: CVE-2022-0847
  2. 2 MITRE ATT&CK: Exploitation for Privilege Escalation (T1068)
#CVE-2022-0847 #cyber attack news #cyber security #cyber security news #cybersecurity news #Dirty Cow #Dirty Pipe #kernel #Linux #news hackers #root #root access #security news #vulnerability
Share

In This Article

TermsThreat actor

Where To Next.

All Security News Articles
In plain words · Glossary term Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Open → Keep reading · Article New Android Malware Detected to Hijack Google Authenticator MFA Tokens: “Escobar”

The Aberebot Android banking trojan returned as Escobar, posing as antivirus, and can steal Google Authenticator MFA codes to take over bank accounts.

Open → Keep reading · Article Critical Security Vulnerabilities Detected in TerraMaster TOS

Octagon Networks found critical flaws in TerraMaster TOS, including CVE-2022-24990, that let remote attackers run code on TNAS storage devices.

Open →
Next in the Linux file · 2 of 4A New Linux Backdoor Detected to Deployed with Log4Shell Vulnerabilities Continue →

Knowledge HubThreat group profiles CVE-2022-0847cyber attack newscyber security