CVE-2022-0847: Linux Kernel Privilege Escalation, actively exploited

Description

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Ovirt Ovirt-engine4.4.10.2

Redhat Codeready Linux Builderall versions

Redhat Virtualization Host4.0

Fedoraproject Fedora35

Linux Kernel≥ 5.15 < 5.15.25 · ≥ 5.16 < 5.16.11 · ≥ 5.8 < 5.10.102

Netapp H300e Firmwareall versions

Netapp H300s Firmwareall versions

Netapp H410c Firmwareall versions

Netapp H410s Firmwareall versions

Netapp H500e Firmwareall versions

Netapp H500s Firmwareall versions

Netapp H700e Firmwareall versions

Netapp H700s Firmwareall versions

Redhat Enterprise Linux For Ibm Z Systems8.0

Redhat Enterprise Linux For Ibm Z Systems Eus8.2 · 8.4

Redhat Enterprise Linux For Real Time8

Redhat Enterprise Linux For Real Time For Nfv8

Redhat Enterprise Linux For Real Time For Nfv Tus8.2 · 8.4

Redhat Enterprise Linux For Real Time Tus8.2 · 8.4

Redhat Enterprise Linux Server Aus8.2 · 8.4

Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions8.1 · 8.2 · 8.4

Redhat Enterprise Linux Server Tus8.2 · 8.4

Redhat Enterprise Linux Server Update Services For Sap Solutions8.1 · 8.2 · 8.4

Siemens Scalance Lpe9403 Firmware< 2.0

Remediation

Fixed in

Linux Kernel≥ 5.15.25

Siemens Scalance Lpe9403 Firmware≥ 2.0

Patch & vendor advisories

https://bugzilla.redhat.com/show_bug.cgi?id=2060795

References

http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.htmlThird Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=2060795Issue TrackingPatchThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdfThird Party Advisory
https://dirtypipe.cm4all.com/ExploitThird Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015Third Party Advisory
https://security.netapp.com/advisory/ntap-20220325-0005/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0847US Government Resource

and 1 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2022-0847 being actively exploited?

Yes. CVE-2022-0847 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Apr 2022.

How severe is CVE-2022-0847?

CVE-2022-0847 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 92.8% probability of exploitation.

Which products are affected by CVE-2022-0847?

Affected products include Ovirt Ovirt-engine, Redhat Codeready Linux Builder, Redhat Virtualization Host, Fedoraproject Fedora, Linux Kernel, and 19 more.

How do I fix CVE-2022-0847?

Upgrade affected software to a fixed version, for example Linux Kernel 5.15.25, Siemens Scalance Lpe9403 Firmware 2.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-0847 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo