CVE-2022-0847highbajo ataqueCWE-665

CVE-2022-0847: fallo de gravedad alta en kernel

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Linux+ Monitorear kernel

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA, tiene exploit funcional público y 1 grupo(s) de amenaza la utilizan.

ssvc Actcvss 7.8epss 93%
de la publicación al armael mismo día
Publicada en NVD7 mar
1ª PoC30 mar
metasploit20 feb
CISA KEV+49d
Quién la explota — 1

Grupos conocidos por explotar esta vulnerabilidad (atribución MITRE ATT&CK).

APT / EstatalSea Turtle MITRE ATT&CK
Lo que declaran los fabricantes (VEX)

Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.

Red Hatdocumento VEX ↗
Corregido
14 productos (499 componentes)
Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.2) · Red Hat Enterprise Linux BaseOS EUS (v.8.4) · Red Hat Enterprise Linux BaseOS E4S (v. 8.1) · Red Hat CodeReady Linux Builder (v. 8) · y otros 9
corrección ↗
No afectado
4 productos (154 componentes) — porque el código vulnerable no está presente en el producto
Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Acción exigida por CISAplazo federal: 2022-05-16

Apply updates per vendor instructions.

En resumen

Una falla en el kernel de Linux permite que usuarios sin privilegios escriban en archivos de solo lectura mediante memoria no inicializada en funciones de pipe, posibilitando escalada de privilegios.

Detalle técnico

La vulnerabilidad existe en las funciones copy_page_to_iter_pipe y push_pipe, donde el miembro 'flags' de la estructura de búfer de pipe no se inicializa adecuadamente, permitiendo que valores obsoletos persistan. Un atacante local sin privilegios puede explotarlo para escribir datos arbitrarios en páginas de page cache vinculadas a archivos de solo lectura, eludiendo controles de acceso y escalando privilegios.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
n/a · kernel
PoCs públicas encontradas — 184
exploitdbwww.exploit-db.com/exploits/50808no verificadogithubgithub.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit★ 1139githubgithub.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits★ 737githubgithub.com/r1is/CVE-2022-0847★ 281githubgithub.com/Al1ex/CVE-2022-0847★ 90githubgithub.com/DataDog/dirtypipe-container-breakout-poc★ 77githubgithub.com/basharkey/CVE-2022-0847-dirty-pipe-checker★ 72githubgithub.com/ZZ-SOCMAP/CVE-2022-0847★ 58githubgithub.com/bbaranoff/CVE-2022-0847★ 50githubgithub.com/febinrev/dirtypipez-exploit★ 49githubgithub.com/knqyf263/CVE-2022-0847★ 46githubgithub.com/greenhandatsjtu/CVE-2022-0847-Container-Escape★ 37githubgithub.com/airbus-cert/dirtypipe-ebpf_detection★ 29githubgithub.com/chenaotian/CVE-2022-0847★ 25githubgithub.com/ahrixia/CVE_2022_0847★ 21githubgithub.com/breachnix/dirty-pipe-poc★ 15githubgithub.com/0xIronGoat/dirty-pipe★ 13githubgithub.com/crusoe112/DirtyPipePython★ 11githubgithub.com/crowsec-edtech/Dirty-Pipe★ 10githubgithub.com/LudovicPatho/CVE-2022-0847_dirty-pipe★ 10githubgithub.com/rexpository/linux-privilege-escalation★ 9githubgithub.com/xndpxs/CVE-2022-0847★ 9githubgithub.com/h4ckm310n/CVE-2022-0847-eBPF★ 8githubgithub.com/qwert419/linux-★ 7githubgithub.com/drapl0n/dirtypipe★ 7githubgithub.com/arttnba3/CVE-2022-0847★ 6githubgithub.com/Mustafa1986/CVE-2022-0847-DirtyPipe-Exploit★ 6githubgithub.com/4luc4rdr5290/CVE-2022-0847★ 6githubgithub.com/KianaBin/CVE-2022-0847-Container-Escape★ 5githubgithub.com/nanaao/dirtyPipe-automaticRoot★ 4githubgithub.com/DanaEpp/pwncat_dirtypipe★ 4githubgithub.com/sa-infinity8888/Dirty-Pipe-CVE-2022-0847★ 3githubgithub.com/eduquintanilha/CVE-2022-0847-DirtyPipe-Exploits★ 3githubgithub.com/bluedragonsecurity/Linux-Kernel-Dirty-Pipe-Exploitation-Logic-Bug-★ 3githubgithub.com/EagleTube/CVE-2022-0847★ 3githubgithub.com/Shotokhan/cve_2022_0847_shellcode★ 3githubgithub.com/byteReaper77/Dirty-Pipe★ 3githubgithub.com/gyaansastra/CVE-2022-0847★ 3githubgithub.com/MrP1xel/CVE-2022-0847-dirty-pipe-kernel-checker★ 3githubgithub.com/jpts/CVE-2022-0847-DirtyPipe-Container-Breakout★ 3githubgithub.com/VinuKalana/DirtyPipe-CVE-2022-0847★ 2githubgithub.com/puckiestyle/CVE-2022-0847★ 2githubgithub.com/dadhee/CVE-2022-0847_DirtyPipeExploit★ 2githubgithub.com/mutur4/CVE-2022-0847★ 2githubgithub.com/karanlvm/DirtyPipe-Exploit★ 2githubgithub.com/xiaoLvChen/CVE-2022-0847★ 2githubgithub.com/zzzchuu/Dirty-Pipe★ 2githubgithub.com/ihenakaarachchi/debian11-dirty_pipe-patcher★ 2githubgithub.com/cspshivam/CVE-2022-0847-dirty-pipe-exploit★ 2githubgithub.com/JlSakuya/CVE-2022-0847-container-escape★ 2githubgithub.com/rabomen/Dirty-Pipe★ 2githubgithub.com/tmoneypenny/CVE-2022-0847★ 2githubgithub.com/Gustavo-Nogueira/Dirty-Pipe-Exploits★ 2githubgithub.com/mhanief/dirtypipe★ 2githubgithub.com/0xeremus/dirty-pipe-poc★ 2githubgithub.com/CYB3RK1D/CVE-2022-0847-POC★ 2githubgithub.com/pashayogi/DirtyPipe★ 1githubgithub.com/Mephierr/DirtyPipe_exploit★ 1githubgithub.com/realbatuhan/dirtypipetester★ 1githubgithub.com/muhammad1596/CVE-2022-0847-dirty-pipe-checker★ 1githubgithub.com/mrchucu1/CVE-2022-0847-Docker★ 1githubgithub.com/joeymeech/CVE-2022-0847-Exploit-Implementation★ 1githubgithub.com/lucksec/CVE-2022-0847★ 1githubgithub.com/mattlloyddavies/ps-lab-cve-2022-0847★ 1githubgithub.com/scopion/dirty-pipe★ 1githubgithub.com/ITMarcin2211/CVE-2022-0847-DirtyPipe-Exploit★ 1githubgithub.com/b4dboy17/Dirty-Pipe-Oneshot★ 1githubgithub.com/solomon12354/LockingGirl-----CVE-2022-0847-Dirty_Pipe_virus★ 0githubgithub.com/si1ent-le/CVE-2022-0847★ 0githubgithub.com/nanaao/Dirtypipe-exploit★ 0githubgithub.com/Greetdawn/CVE-2022-0847-DirtyPipe-★ 0githubgithub.com/0xr1l3s/CVE-2022-0847★ 0githubgithub.com/orsuprasad/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/ayushx007/CVE-2022-0847-dirty-pipe-checker★ 0githubgithub.com/JustinYe377/CTF-CVE-2022-0847★ 0githubgithub.com/RogelioPumajulca/CVE-2022-0847★ 0githubgithub.com/CPT-Jack-A-Castle/CVE-2022-0847★ 0githubgithub.com/ajith737/Dirty-Pipe-CVE-2022-0847-POCs★ 0githubgithub.com/Greetdawn/CVE-2022-0847-DirtyPipe★ 0githubgithub.com/AyoubNajim/cve-2022-0847dirtypipe-exploit★ 0githubgithub.com/V0WKeep3r/CVE-2022-0847-DirtyPipe-Exploit★ 0githubgithub.com/githublihaha/DirtyPIPE-CVE-2022-0847★ 0githubgithub.com/MingqiZhang7710/cve-2022-0847-poc-dockerimage★ 0githubgithub.com/Shadow-Spinner/CVE-2022-0847★ 0githubgithub.com/vudangducminh/CVE-2022-0847★ 0githubgithub.com/cypherlobo/DirtyPipe-BSI★ 0githubgithub.com/stfnw/reproducer-poc-CVE-2022-0847★ 0githubgithub.com/edsonjt81/CVE-2022-0847-Linux★ 0githubgithub.com/isaiahsimeone/COMP3320-VAPT★ 0githubgithub.com/jonathanbest7/cve-2022-0847★ 0githubgithub.com/notl0cal/dpipe★ 0githubgithub.com/muhammad1596/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/gaganhm3018-art/CVE-2022-0847-Dirty-Pipe-★ 0githubgithub.com/gladiator-07/CVE-2022-0847★ 0githubgithub.com/DataFox/CVE-2022-0847★ 0githubgithub.com/bohr777/cve-2022-0847dirtypipe-exploit★ 0githubgithub.com/babyshen/CVE-2022-0847★ 0githubgithub.com/osungjinwoo/CVE-2022-0847-Dirty-Pipe★ 0githubgithub.com/jxpsx/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/ayushx007/CVE-2022-0847-DirtyPipe-Exploits★ 0githubgithub.com/mithunmadhukuttan/Dirty-Pipe-Exploit★ 0githubgithub.com/pmihsan/Dirty-Pipe-CVE-2022-0847★ 0githubgithub.com/xsxtw/CVE-2022-0847★ 0githubgithub.com/aswanepo/DirtyPipe★ 0githubgithub.com/morgenm/dirtypipe★ 0githubgithub.com/Scouserr/cve-2022-0847-poc-dockerimage★ 0githubgithub.com/honeyvig/CVE-2022-0847-DirtyPipe-Exploit★ 0githubgithub.com/SimoesCTT/Chrono-Drip-Temporal-Viscosity-Exploitation-Framework-CVE-2022-0847★ 0githubgithub.com/real-tim-johnston/megaquagga-pentest-report★ 0githubgithub.com/t1ckprivate/CVE-2022-0847-Dirty-Pipe★ 0githubgithub.com/stfnw/Debugging_Dirty_Pipe_CVE-2022-0847★ 0githubgithub.com/tufanturhan/CVE-2022-0847-L-nux-PrivEsc★ 0githubgithub.com/pentestblogin/pentestblog-CVE-2022-0847★ 0githubgithub.com/edsonjt81/CVE-2022-0847-DirtyPipe-★ 0githubgithub.com/letsr00t/CVE-2022-0847★ 0githubgithub.com/JeevanAnand1202/Penetration-Test★ 0vulncheckvulncheck.com/xdb/e951505f0751no verificadovulncheckvulncheck.com/xdb/39d930add800no verificadovulncheckvulncheck.com/xdb/53f491f20736no verificadovulncheckvulncheck.com/xdb/4221c9725688no verificadovulncheckvulncheck.com/xdb/3a93ca8aad3bno verificadocve_referencepacketstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.htmlno verificadocve_referencepacketstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.htmlno verificadovulncheckvulncheck.com/xdb/1fddbe10b98cno verificadovulncheckvulncheck.com/xdb/e2dbb982b5dano verificadovulncheckvulncheck.com/xdb/5753c6aff2e2no verificadovulncheckvulncheck.com/xdb/df0bacb0b7bcno verificadovulncheckvulncheck.com/xdb/4a62a2a669beno verificadovulncheckvulncheck.com/xdb/11089b6096c2no verificadovulncheckvulncheck.com/xdb/8d1294672787no verificadovulncheckvulncheck.com/xdb/bef271559611no verificadovulncheckvulncheck.com/xdb/a3b3ce85d0a5no verificadovulncheckvulncheck.com/xdb/5a77169c0797no verificadovulncheckvulncheck.com/xdb/42ba5e95ff5bno verificadovulncheckvulncheck.com/xdb/c4258f9dc626no verificadovulncheckvulncheck.com/xdb/57ffde1c1df6no verificadovulncheckvulncheck.com/xdb/5e1cd4381cd2no verificadovulncheckvulncheck.com/xdb/8fecaa2db7c9no verificadovulncheckvulncheck.com/xdb/7681898c4d58no verificadovulncheckvulncheck.com/xdb/e4ea692dc95eno verificadovulncheckvulncheck.com/xdb/bc3dc26b7001no verificadovulncheckvulncheck.com/xdb/a76c9b8da62ano verificadovulncheckvulncheck.com/xdb/46be9d6ea639no verificadovulncheckvulncheck.com/xdb/86e89699a34ano verificadovulncheckvulncheck.com/xdb/4876d153c69ano verificadovulncheckvulncheck.com/xdb/54b99f9179fbno verificadovulncheckvulncheck.com/xdb/c735aeb744eano verificadovulncheckvulncheck.com/xdb/d6a71047f04cno verificadovulncheckvulncheck.com/xdb/d34eb7cc4235no verificadovulncheckvulncheck.com/xdb/79c51557e8e7no verificadovulncheckvulncheck.com/xdb/b7ade02a3da0no verificadovulncheckvulncheck.com/xdb/830e350bd642no verificadovulncheckvulncheck.com/xdb/6c64ccbb8d52no verificadovulncheckvulncheck.com/xdb/27ac660f03deno verificadovulncheckvulncheck.com/xdb/96d8ebedfe2fno verificadovulncheckvulncheck.com/xdb/6651072dd4a6no verificadovulncheckvulncheck.com/xdb/610fa05f7ec4no verificadovulncheckvulncheck.com/xdb/a77a7570c91bno verificadovulncheckvulncheck.com/xdb/b665c30d7b05no verificadovulncheckvulncheck.com/xdb/17eac3a8349dno verificadovulncheckvulncheck.com/xdb/de3da6925a66no verificadovulncheckvulncheck.com/xdb/e74c2b6094acno verificadovulncheckvulncheck.com/xdb/d542c059ef55no verificadovulncheckvulncheck.com/xdb/d3a70ff7bafdno verificadovulncheckvulncheck.com/xdb/370b7021f8a9no verificadovulncheckvulncheck.com/xdb/d3ad03153f6eno verificadovulncheckvulncheck.com/xdb/0ff57a4fbafcno verificadovulncheckvulncheck.com/xdb/39fa7f44daa8no verificadovulncheckvulncheck.com/xdb/82740f737207no verificadovulncheckvulncheck.com/xdb/a83519a93931no verificadovulncheckvulncheck.com/xdb/cbca31fa2346no verificadovulncheckvulncheck.com/xdb/986760f90254no verificadovulncheckvulncheck.com/xdb/7f2dbb1be2fano verificadovulncheckvulncheck.com/xdb/7a4fbe4458fbno verificadovulncheckvulncheck.com/xdb/f44fe86cdbd8no verificadovulncheckvulncheck.com/xdb/3b34006b6ed8no verificadovulncheckvulncheck.com/xdb/8700be3bde3fno verificadovulncheckvulncheck.com/xdb/d2e7f7cbb621no verificadovulncheckvulncheck.com/xdb/fd2f2968f48cno verificadovulncheckvulncheck.com/xdb/2d68d5611e4bno verificadocve_referencepacketstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.htmlno verificadocve_referencepacketstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.htmlno verificadovulncheckvulncheck.com/xdb/138c1f528926no verificadovulncheckvulncheck.com/xdb/b13d9281b078no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.