38 lines
1.6 KiB
Markdown
38 lines
1.6 KiB
Markdown
# CVE-2022-0847: "Dirty Pipe": overwriting read-only page-cache pages via pipe buffer flags
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
CVSS 7.8. Fixed in Linux 5.16.11, 5.15.25, 5.10.102.
|
|
|
|
## Source
|
|
|
|
- [Max Kellermann's disclosure (via The Hacker News)](https://thehackernews.com/2022/03/researchers-warn-of-linux-kernel-dirty.html)
|
|
- [LWN coverage](https://lwn.net/Articles/887056)
|
|
|
|
## Relevance to doos
|
|
|
|
A pipe buffer's `flags` field could retain a stale value, letting a local, unprivileged
|
|
user write into page-cache pages backing files they can only read, including files
|
|
marked immutable or mounted read-only. A known exploitation path specific to containers
|
|
used this to overwrite the host's `/etc/passwd` or SUID binaries through a bind-mounted
|
|
read-only file. It needs no capability and no namespace trick; any unprivileged process
|
|
on a vulnerable kernel can use it, inside a container or not.
|
|
|
|
|
|
## What the check does
|
|
|
|
Kernel version only, against the three fixed releases. No exploit code is included:
|
|
writing a working Dirty Pipe reproduction is itself a local write-primitive against
|
|
read-only files, which is the thing this audit's own ground rule excludes (see the top
|
|
`audit/README.md`, "What is deliberately not here").
|
|
|
|
|
|
## Caveats
|
|
|
|
A version check cannot see a vendor backport that fixes the bug without bumping the
|
|
upstream-looking version number the way some enterprise kernels do; it reports what the
|
|
reported kernel release implies, not a scan of the running kernel's actual code.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|