Researchers warn of Linux kernel Dirty Pipe arbitrary-file overwrite vulnerability

Linux distributions are releasing patches to address a newly disclosed kernel security vulnerability that could let an attacker overwrite arbitrary data in read-only files and take full control of affected systems.

Named Dirty Pipe (CVE-2022-0847, CVSS score: 7.8) by IONOS software developer Max Kellermann, the flaw leads to privilege escalation because unprivileged processes can inject code into root processes.

Kellermann said the bug was discovered while investigating a support issue raised by one of the cloud and hosting provider's customers involving an unexpected form of corruption affecting web-server access logs.

The Linux kernel flaw is said to have existed since version 5.8. It shares similarities with Dirty Cow (CVE-2016-5195), which came to light in October 2016.

"A flaw was found in the way the flags member of the new pipe-buffer structure was not properly initialised in the Linux kernel's copy_page_to_iter_pipe and push_pipe functions and could therefore contain stale values," Red Hat explained in an advisory.

"An unprivileged local user could use this flaw to write to pages in the page cache backed by read-only files and thereby escalate their privileges on the system," it added.

A pipe, short for pipeline, is a one-way inter-process communication mechanism in which processes are connected so that each receives data from the previous process and produces output for the next.

Exploiting the weakness involves creating a pipe, filling it with arbitrary data, draining it, splicing data from the target read-only file and writing arbitrary data to the pipe, Kellermann described in a proof of concept (PoC) demonstrating the flaw.

The vulnerability is high risk because it allows an attacker to carry out malicious actions on the system, including tampering with sensitive files such as /etc/passwd to remove a root user's password, adding SSH keys for remote access, and running arbitrary binaries with the highest privileges.

Another harmful action enabled by Dirty Pipe is modifying files in container images, provided a malicious user has access to a single container on the host.

"If they have that access and the kernel version is vulnerable, they can modify any files in the image used to create the container they can access, or files mounted read-only from the underlying host," Aqua Security's Rory McCune said in a report.

"To make this vulnerability more interesting, it works not only without write permissions, but also with immutable files, read-only btrfs snapshots and read-only mounts, including CD-ROM mounts," the researcher said. "This is because the page cache is always writable by the kernel, and writing to a pipe never checks permissions."

"To make this vulnerability more interesting, it works not only without write permissions, but also with immutable files, btrfs snapshots and read-only mounts, including CD-ROM mounts," the researcher said. "This is because the page cache is always writable by the kernel, and writing to a pipe never checks permissions."

The issue was fixed in Linux versions 5.16.11, 5.15.25 and 5.10.102 on 23 February 2022, three days after it was reported to the Linux kernel security team. Google merged the fixes into the Android kernel on 24 February 2022.

Given how easily the security flaw can be exploited and the release of a PoC exploit, users are advised to update Linux servers immediately and apply patches for other distributions as soon as they become available.