CVE-2022-0847 Exploits

Dirty Pipe

What is it ?

Disclosed on March 7, 2022 by Max Kellerman[2], CVE-2022-0847 is a vulnerability in the Linux kernel (versions 5.8 to 5.16.11) that allows attackers to overwrite read-only or immutable files and escalate their privileges on the victim's system. CVE-2022-0847 was nicknamed Dirty Pipe and has a CVSS score of 7.8 (considered high).

How does the vulnerability exploitation work?

The Dirty Pipe vulnerability is described as a flaw in the way the flags attribute of the struct pipe_buffer[7] did not have proper initialization in the copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and thus could contain stale values. One of the flags that can be set in the flags attribute of struct pipe_buffer is the flag called PIPE_BUF_FLAG_CAN_MERGE. It indicates whether merging more data into the pipe_buffer is allowed or not. Thus, when data is copied to a pipe_buffer, more data can be added to the pipe_buffer if the copied page is less than 4096 bytes in size.

By injecting PIPE_BUF_FLAG_CAN_MERGE into a page cache reference, it became possible to overwrite data in the page cache simply by writing new data to a specially prepared pipe (this process will be described in the following paragraphs). Thus, an unprivileged local user can use this flaw to overwrite/write to pages in the page cache backed by read-only files and thus escalate their privileges on the system.

That said, to exploit the vulnerability, the following steps must be followed:

1. Create a pipe.
2. Fill the pipe with arbitrary data (to set the PIPE_BUF_FLAG_CAN_MERGE flag in all entries of the circular array).
3. Drain the pipe (leaving the PIPE_BUF_FLAG_CAN_MERGE flag set in all struct pipe_buffer instances of the circular array). Normally, the flag should be reset. However, the Dirty Pipe vulnerability causes the flag to remain set to 1.
4. Transfer a read-only file to the pipe using the splice syscall.
5. Modify the read-only file. Since the splice system call uses the pass-by-reference method, the attacker can overwrite the file due to the PIPE_BUF_FLAG_CAN_MERGE flag.

Exploits

Compile everything with the following command:

make

Exploit 1 - Overwriting Read-Only Files

Running

./exploit-1

Description

Exploit 1, present in the file exploit-1.c of the repository, consists of overwriting the root user's password present in the file /etc/passwd (this file contains user account information, such as the encrypted password) and finally providing a terminal with root access. To do so, it was necessary to:

1. Make a backup of the /etc/passwd file.
2. Prepare the pipe (as presented in steps 1, 2, and 3 above) with the PIPE_BUF_FLAG_CAN_MERGE flag.
3. Transfer the /etc/passwd file to the pipe and overwrite the contents of this file with a new known root password (as presented in steps 4 and 5 above).
4. Create a session as root using the new password set.
5. Then, the password is reset to the original value from the backup, thus leaving no traces.
6. Finally, still with the root session established, a shell terminal with root access is released.

Exploit 2 - Hijacking SUID Binaries

Finding SUID Binaries

find / -perm -4000 2>/dev/null

Running

./exploit-2 <path-of-suid-binary>

Description

Exploit 2, present in the file exploit-2.c of the repository, consists of overwriting/hijacking a SUID binary (this type of attack was reported in section 3.5.2) and finally providing a terminal with root access. To do so, it was necessary to:

1. Prepare an ELF (Executable and Linking Format) executable code that will be used to overwrite the received SUID binary to be passed as a parameter. In the exploit, the ELF executable used creates a new executable file (/tmp/sh), which in turn creates a shell terminal with root access.
2. Receive the path of a SUID binary as a parameter.
3. Make a backup of the received binary.
4. Prepare the pipe (as presented in steps 1, 2, and 3 above) with the PIPE_BUF_FLAG_CAN_MERGE flag.
5. Transfer the received binary file to the pipe and overwrite the contents of this file with the ELF executable mentioned in step 1 (as presented in steps 4 and 5 above).
6. Then, the received binary is restored to its original content from the backup, thus leaving no traces.
7. Finally, the executable file /tmp/sh mentioned in step 1 is executed, thus opening a new shell with root access.

Exploit 3 - Adding Key for Remote Access

Running

./exploit-3

Description

Exploit 3, present in the file exploit-3.c of the repository, uses the same steps as exploit 1 to obtain root shell access. The difference is that exploit 3, after gaining root shell access, loads an attacker's SSH (Secure Shell) public key into the file /root/.ssh/authorized_keys and creates a TCP (Transmission Control Protocol) tunnel for remote SSH access using the Ngrok platform.

References

[1] AHMED, Alexis. Privilege Escalation Techniques: Learn the art of exploiting Windows and Linux systems. Birmingham: Packt Publishing, October 2021.

[2] KELLERMANN, Max. The Dirty Pipe Vulnerability. Available at: https://dirtypipe.cm4all.com/. Accessed on: July 23, 2022.

[3] Exploit Database. Available at: https://www.exploit-db.com/. Accessed on: August 3, 2022.

[4] Traitor: Automatically exploit low-hanging fruit to pop a root shell. Available at: https://github.com/liamg/traitor. Accessed on: August 3, 2022.

[5] PayloadsAllTheThings. Linux - Privilege Escalation. Available at: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md#cve-2022-0847-dirtypipe. Accessed on: August 3, 2022.

[6] Linux Kernel Repository - Struct pipe_inode_info. Available at: https://github.com/torvalds/linux/blob/v5.8/include/linux/pipe_fs_i.h#L76. Accessed on: August 3, 2022.

[7] Linux Kernel Repository - Struct pipe_buffer. Available at: https://github.com/torvalds/linux/blob/v5.8/include/linux/pipe_fs_i.h#L26-L32. Accessed on: August 3, 2022.

[8] ARNTZ, Pieter. Linux "Dirty Pipe" vulnerability gives unprivileged users root access. Malwarebytes Lab. Available at: https://www.malwarebytes.com/blog/news/2022/03/linux-dirty-pipe-vulnerability-gives-unprivileged-users-root-access. Accessed on: August 3, 2022.

[9] Picus Security. Linux “Dirty Pipe” CVE-2022-0847 Vulnerability Exploitation Explained. Available at: https://www.picussecurity.com/resource/linux-dirty-pipe-cve-2022-0847-vulnerability-exploitation-explained. Accessed on: August 3, 2022.

[10] Exploit Database - Local Privilege Escalation (Dirty Pipe). Available at: https://www.exploit-db.com/exploits/50808. Accessed on: August 3, 2022.