CVE-2022-0847
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe…
High
Known exploited
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 92.80%
- Chance of exploitation in the next 30 days. Higher than 99.83% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Apr 25, 2022
- Fix
- None yet
- No fixed version published
Exploited in the wild. Linux Kernel Privilege Escalation Vulnerability (Linux Kernel). Required action: Apply updates per vendor instructions. Due for U.S. federal agencies by May 16, 2022.
Description
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
- Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
- Implementation: Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile your product with settings that generate warnings about uninitialized variables or data.
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
- Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
- Implementation: Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile your product with settings that generate warnings about uninitialized variables or data.
References
Advisories
- packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html
- packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html
- packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html
- packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html
- bugzilla.redhat.com/show_bug.cgi
- cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- dirtypipe.cm4all.com
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015
- security.netapp.com/advisory/ntap-20220325-0005
- suse.com/support/kb/doc
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) | Medium | Same weakness, CWE-665 |
| GHSA-2fqr-mr3j-6wp8 aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence | High | Same weakness, CWE-665 |
| GHSA-7rrj-xr53-82p7 Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe | Medium | Same weakness, CWE-665 |
| GHSA-v2cv-wwxq-qq97 Moby Docker cp broken with debian containers | Critical | Same weakness, CWE-665 |
| GHSA-pw3c-h7wp-cvhx Improper Initialization in Pillow | Medium | Same weakness, CWE-665 |
| GHSA-9c22-pwxw-p6hx Improper Initialization in OpenZeppelin | Medium | Same weakness, CWE-665 |
| GHSA-5vp3-v4hc-gx76 UUPSUpgradeable vulnerability in @openzeppelin/contracts | Critical | Same weakness, CWE-665 |
| GHSA-vvg4-vgrv-xfr7 Incomplete validation in `tf.raw_ops.CTCLoss` | Medium | Same weakness, CWE-665 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor