CVE-2022-0847highunder attackCWE-665

CVE-2022-0847: high-severity vulnerability in kernel

Published 07 Mar 2022 · Updated 21 Oct 2025

Follow this CVE + Monitor Linux + Monitor kernel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 93%

from disclosure to weaponsame day

Published on NVDMar 7

1st PoCMar 30

metasploitFeb 20

CISA KEV+49d

Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateSea Turtle MITRE ATT&CK

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Fixed

14 products (499 components)

Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.2) · Red Hat Enterprise Linux BaseOS EUS (v.8.4) · Red Hat Enterprise Linux BaseOS E4S (v. 8.1) · Red Hat CodeReady Linux Builder (v. 8) · and others 9

fix ↗

Not affected

4 products (154 components) — because the vulnerable code is not present in the product

Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · RHEL 8-based RHEV-H for RHEV 4 (build requirements)

Action required by CISAfederal deadline: 2022-05-16

Apply updates per vendor instructions.

In short

A Linux kernel flaw allows unprivileged users to write to read-only files through uninitialized memory in pipe functions, enabling privilege escalation on affected systems.

Technical detail

The vulnerability exists in copy_page_to_iter_pipe and push_pipe functions where the 'flags' member of the pipe buffer structure is not properly initialized, allowing stale values to persist. An unprivileged local attacker can exploit this to write arbitrary data to page cache pages backed by read-only files, bypassing access controls and escalating privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · kernel

public PoCs found — 211

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html http://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html http://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html https://bugzilla.redhat.com/show_bug.cgi?id=2060795 https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf https://dirtypipe.cm4all.com/https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015 https://security.netapp.com/advisory/ntap-20220325-0005/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0847 https://www.suse.com/support/kb/doc/?id=000020603