Dirty Pipe Explained: CVE-2022-0847 Linux Privilege Escalation Vulnerability

In March 2022, a significant Linux kernel vulnerability nicknamed “Dirty Pipe” (CVE-2022-0847) was disclosed. This flaw allowed an unprivileged local user to perform a powerful privilege escalation by overwriting data in arbitrary read-only files.

By exploiting a bug in the kernel’s pipe buffer handling, an attacker could gain root access on affected systems.

While this vulnerability was patched quickly, understanding its mechanics provides crucial insight into kernel security, page cache behavior, and the importance of timely updates for any security-focused home lab.

Vulnerability at a Glance

CVE ID	CVE-2022-0847
Vulnerability Type	Local Privilege Escalation
Affected Versions	Linux kernels from 5.8 up to 5.16.10, 5.15.24, and 5.10 before 5.10.102 (commonly cited as 5.10.101).
Discovered By	Max Kellermann
Patched Version	Fixed in Linux 5.16.11, 5.15.25, and 5.10.102, released March 2022.

How the Vulnerability Works

The root cause lies in a performance optimization added to the Linux kernel.

The kernel allowed pipe buffers flagged with PIPE_BUF_FLAG_CAN_MERGE to be spliced and merged with a page already residing in the system’s page cache, which holds frequently accessed file data in memory for speed.

A critical missing check meant an attacker could obtain a reference to a read-only cached page, inject it into a pipe, and then write attacker-controlled data into that pipe.

This data would be merged directly into the cached page, bypassing all normal filesystem permission checks.

In essence, it allowed writing to the cached image of any file the kernel had recently read, regardless of the user’s write permissions on the actual file.

Lab Walkthrough

The following walkthrough demonstrates the exploitation of CVE-2022-0847 in a controlled, authorized lab environment for educational purposes. Do not attempt this on systems you do not own or have explicit permission to evaluation.

Reconnaissance

First, we confirm we are on a vulnerable system as a low-privilege user (e.g., “student”) and check the kernel version.

$ id
uid=1001(student) gid=1001(student) groups=1001(student)

$ uname -a
Linux labhost 5.10.101 #1 SMP ... x86_64 GNU/Linux

Exploitation

Two primary exploitation paths were publicly demonstrated. The first involves directly modifying a critical read-only file like /etc/passwd.

By calculating the correct byte offset, an attacker can overwrite the UID field of a service account (like “daemon”) to 0, effectively granting it root privileges.

After compiling the public proof-of-concept exploit (often named exploit.c), the attack might look like this (using placeholder data for illustration).

$ gcc exploit.c -o exploit
$ ./exploit /etc/passwd 1234 "daemon:x:0:0:..."
[+] Data successfully written.

The second, more general technique hijacks a SUID-root binary. We first locate such a binary on the system.

$ find / -perm -4000 -type f 2>/dev/null | head -5
/usr/bin/sudo
/usr/bin/pkexec
/usr/bin/passwd
...

We then use a variant of the exploit (often called dirtypipez.c) against a target like /usr/bin/sudo.

This exploit works by splicing a modified copy of the binary into the pipe, writing a payload that creates a new SUID-root shell binary (e.g., at /tmp/sh), and then restoring the original binary to avoid detection.

After compiling and running the exploit.

$ gcc dirtypipez.c -o dirtypipez
$ ./dirtypipez /usr/bin/sudo
[+] Successfully dropped SUID shell at /tmp/sh
$ /tmp/sh -p
# id
uid=1001(student) gid=1001(student) euid=0(root) groups=1001(student)

The exploit has succeeded, granting an effective root shell. As good practice in a lab, remember to clean up any dropped files like /tmp/sh after your session.

Practicing these techniques in a safe, isolated environment, such as one built on a dedicated mini PC, is fundamental for defensive security education.

Mitigation and Patching

The primary and definitive mitigation is to update the Linux kernel to a patched version. The fix was included in Linux kernel versions 5.16.11, 5.15.25, and 5.10.102. All major Linux distributions quickly backported the patch to their supported kernels.

Therefore, applying standard operating system updates via your package manager resolves the vulnerability. As a defense-in-depth measure, limit local shell access for untrusted users and monitor sensitive files like /etc/passwd for unexpected permission or UID changes.

Keeping your entire home lab stack updated is a core tenet of proactive cybersecurity.

Frequently Asked Questions

Is my modern Linux system still vulnerable to Dirty Pipe?

No. The vulnerability was patched in March 2022. Any system that has received standard kernel updates since then is not vulnerable. You can verify your kernel version with the command uname -r.

Can Dirty Pipe be exploited remotely?

No. CVE-2022-0847 is a local privilege escalation vulnerability. An attacker must first have a foothold on the system with the ability to execute code as a local, unprivileged user.

Why is it important to study old vulnerabilities?

Studying patched vulnerabilities like Dirty Pipe is invaluable for understanding complex kernel mechanisms, such as the page cache and pipe buffers.

It reinforces the critical importance of patch management and teaches patterns of flaw discovery that can aid in defensive code review and future vulnerability research.

What is the best way to practice these concepts safely?

The safest method is to use a deliberately vulnerable virtual machine or container in an isolated lab environment that you fully control. This allows for direct experimentation with exploits and mitigation techniques without any risk to production or external systems.

About the author