What’s Vulnerable › Vulnerabilities
CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2022-04-25
- EPSS: 92.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-03-10 · updated 2026-06-17
- Weakness: CWE-665
Description
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
Affected products
- Fedoraproject Fedora: 35
- Linux kernel: from 5.8 before 5.10.102; from 5.15 before 5.15.25; from 5.16 before 5.16.11 — fixed in 5.10.102, 5.15.25, 5.16.11
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- ovirt-engine: 4.4.10.2
- RedHat Codeready Linux Builder: all versions
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Eus: 8.2, 8.4
- RedHat Enterprise Linux For Ibm Z Systems: 8.0
- RedHat Enterprise Linux For Ibm Z Systems Eus: 8.2, 8.4
- RedHat Enterprise Linux For Power Little Endian: 8.0
- RedHat Enterprise Linux For Power Little Endian Eus: 8.2, 8.4
- RedHat Enterprise Linux For Real Time: 8
- RedHat Enterprise Linux For Real Time For Nfv: 8
- RedHat Enterprise Linux For Real Time For Nfv Tus: 8.2, 8.4
- RedHat Enterprise Linux For Real Time Tus: 8.2, 8.4
- RedHat Enterprise Linux Server Aus: 8.2, 8.4
- RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 8.1, 8.2, 8.4
- RedHat Enterprise Linux Server Tus: 8.2, 8.4
- RedHat Enterprise Linux Server Update Services For Sap Solutions: 8.1, 8.2, 8.4
- RedHat Virtualization Host: 4.0
- Siemens SCALANCE LPE9403: before 2.0 — fixed in 2.0
- SonicWall SMA1000: through 12.4.2-02044
How to fix
Upgrade to a fixed version: Linux kernel 5.10.102, 5.15.25, 5.16.11; Siemens SCALANCE LPE9403 2.0. Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html
- http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html
- http://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2060795
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- https://dirtypipe.cm4all.com/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015
- https://security.netapp.com/advisory/ntap-20220325-0005/
- https://www.suse.com/support/kb/doc/?id=000020603
- http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html
- http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html
Get alerted when CVE-2022-0847 or the next vulnerability affects your stack