1.6 KiB
CVE-2022-0847: "Dirty Pipe": overwriting read-only page-cache pages via pipe buffer flags
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 7.8. Fixed in Linux 5.16.11, 5.15.25, 5.10.102.
Source
Relevance to doos
A pipe buffer's flags field could retain a stale value, letting a local, unprivileged
user write into page-cache pages backing files they can only read, including files
marked immutable or mounted read-only. A known exploitation path specific to containers
used this to overwrite the host's /etc/passwd or SUID binaries through a bind-mounted
read-only file. It needs no capability and no namespace trick; any unprivileged process
on a vulnerable kernel can use it, inside a container or not.
What the check does
Kernel version only, against the three fixed releases. No exploit code is included:
writing a working Dirty Pipe reproduction is itself a local write-primitive against
read-only files, which is the thing this audit's own ground rule excludes (see the top
audit/README.md, "What is deliberately not here").
Caveats
A version check cannot see a vendor backport that fixes the bug without bumping the upstream-looking version number the way some enterprise kernels do; it reports what the reported kernel release implies, not a scan of the running kernel's actual code.
Run: make test in this directory, or make -C audit test from the repo root.