gaganhm3018-art/cve-2022-0847-dirty-pipe-this is a repo who is facing a escalation issue in their linux system and a news regarding problem of "Dirty pipeline"
Max Kellermann, a developer at CM4all (a German web hosting company), found it in early 2022 but not by checking for vulnerability. He was debugging when he knows that the customer was dissatified with the that logs on their server were corrupting spontaneously. Kellermann spent months tracing it. His work eventually led him to a condition deep in how the Linux kernel handles pipes and page cache. He realized the bug he found to explain the log corruption was actually something far more serious — a full privilege escalation vulnerability (A full privilege escalation vulnerability is a critical security flaw that allows an attacker with low-level access—such as a standard user, guest, or unprivileged application—to gain administrative, superuser, or root-level control over a system. This means the attacker bypasses all intended security boundaries, granting them complete control to modify system files, install software, steal data, or delete files) . He responsibly disclosed it to the Linux kernel team and Linus Torvalds himself. It was patched within days The real problem is -- when splice() transferred data into a pipe, it forgot to clear this flag on the destination buffer. So the splice'd page (which points directly into the read-only page cache of a file) still had CAN_MERGE set. Now if you write to that pipe, the kernel sees CAN_MERGE, assumes the page is writable, and merges your data directly into the page cache — which is the file's in-memory content —> without any permission check. Result: you can overwrite the contents of any file readable by you, including SUID (set user ID) root binaries like su, passwd, sudo. Why was the bug so important A few reasons:
