Dirty Pipe is a Linux vulnerability, that can allow local users to gain root privileges.

Security expert Max Kellermann discovered a Linux flaw, dubbed Dirty Pipe and tracked as CVE-2022-0847, that can allow local users to gain root privileges on all major distros.

The vulnerability affects Linux Kernel 5.8 and later versions.

The CVE-2022-0847 vulnerability allows overwriting data in arbitrary read-only files, which could lead to privilege escalation because unprivileged processes can inject code into root processes.

Kellerman explained that the flaw is similar to CVE-2016-5195, aka Dirty Cow, and is more dangerous because it is easier to exploit.

Max has described what happens.

Kellerman published technical details about the Dirty Pipe flaw along with a proof-of-concept (PoC) exploit that allows local users to overwrite any file contents in the page cache, even if the file is not permitted to be written, immutable or on a read-only mount.

BleepingComputer reported a tweet published by the security researcher Phith0n who explained that it is possible to use the exploit to modify the /etc/passwd file to set the root user without a password. Using this trick a non-privileged user could execute the command ‘su root’ to gain access to the root account.

Why did I overwrite the /etc/passwd?Because this file saves all the user information on Linux.I remove the “x” flag behind the “root” user, it means that I set an empty password for this user. So I can use “su root” to escalate privilege without credentials.— Phith0n (@phithon_xg) March 7, 2022The researcher Phith0n also published an updated version of the exploit that allows gaining root privileges by overwriting a SUID program like ./exp /usr/bin/su to drop a root shell at /tmp/sh and then executing the script.

the timeline for the vulnerability

2021-04-29: first support ticket about file corruption2022-02-19: file corruption problem identified as Linux kernel bug, which turned out to be an exploitable vulnerability2022-02-20: bug report, exploit and patch sent to the Linux kernel security team2022-02-21: bug reproduced on Google Pixel 6; bug report sent to the Android Security Team2022-02-21: patch sent to LKML (without vulnerability details) as suggested by Linus Torvalds, Willy Tarreau and Al Viro2022-02-23: Linux stable releases with my bug fix (5.16.11, 5.15.25, 5.10.102)2022-02-24: Google merges my bug fix into the Android kernel2022-02-28: notified the linux-distros mailing list2022-03-07: public disclosureServers running outdated kernel versions are exposed to attacks exploiting this flaw.

The post Dirty Pipe Linux flaw allows gaining root privileges on major distros appeared first on Security Affairs.