Dirty Pipe (CVE-2022-0847): A Hands-On Exploit Demonstration in Docker

This repository provides a self-contained, interactive Docker environment to safely demonstrate and analyze the "Dirty Pipe" privilege escalation vulnerability. It is designed as an educational tool for security professionals to understand the mechanics of a critical kernel-level exploit within a controlled setting.

1. The Vulnerability Explained: What is Dirty Pipe?

Dirty Pipe was a critical vulnerability discovered in the Linux kernel (affecting versions from 5.8 onwards). It allowed a local, unprivileged user to overwrite data in arbitrary read-only files.

The impact is severe: by overwriting a sensitive file like /etc/passwd or a SUID binary, an attacker could easily escalate their privileges to root, gaining complete control of the system. This vulnerability was particularly dangerous because it bypassed standard file permission checks, a fundamental security control in Linux.

2. Project Architecture: Using Docker for a Safe Lab

This project leverages Docker to create a safe, isolated, and intentionally vulnerable environment. This allows anyone to study the exploit without risking their host machine.

The key components are:

• Dockerfile: Defines the blueprint for our vulnerable container. It uses an older base image (debian:bullseye-20210927-slim) known to have a kernel susceptible to Dirty Pipe, and it automates the setup process.
• exploit.c: The C code that implements the exploit logic, based on the original proof-of-concept by Max Kellermann.
• Makefile: A simple makefile to compile the C code into an executable binary within the container.

3. Hands-On Demonstration: From User to Root

This walkthrough will guide you through building the environment and executing the exploit.

Prerequisites: You must have Docker installed and running on your system.

Step 1: Clone the Repository

Open your terminal and clone this project.

git clone https://github.com/mrchucu1/CVE-2022-0847-Docker.git
cd CVE-2022-0847-Docker

Step 2: Build the Vulnerable Docker Image

Use the docker build command to create the container image. The Dockerfile will handle all dependencies and compile the exploit code.

docker build -t dirty-pipe-demo .

Step 3: Run the Container & Execute the Exploit

Now, run the container interactively. The --rm flag ensures the container is deleted upon exit, and -it gives you an interactive shell.

docker run --rm -it dirty-pipe-demo

You will be dropped into a shell inside the container as an unprivileged user (hacker@...:/$).

Now, execute the pre-compiled exploit:

# You are currently an unprivileged user.
# Your prompt looks like this: hacker@<container_id>:/$
#
# Now run the exploit...
./exploit

Success! The exploit overwrites a SUID binary to grant you a root shell. Your terminal prompt will change from $ to #, indicating you now have root privileges.

# The exploit has succeeded.
# Your prompt is now a root shell: # whoami
root
#

4. Key Security Takeaways & Learnings

This project is more than just running a script; it is a practical demonstration of critical security principles relevant to my work as a Cloud Security Engineer:

• Kernel Exploits Bypass Application-Layer Security: This shows that even with perfect file permissions, a kernel vulnerability can undermine the entire security model of an operating system, proving that defense-in-depth is essential.
• Container Security is Host Security: It provides tangible proof that containers share the host's kernel. A kernel exploit executed within a container can lead to a full breakout and compromise of the host machine. This highlights the importance of using seccomp profiles, gVisor, or container-optimized OSes in production.
• The Criticality of Patch Management: This is a live example of why timely kernel updates are a non-negotiable security practice in any production environment, especially on container hosts.
• Understanding the Attack Surface: By building the exploit environment, I gained a deeper appreciation for how attackers analyze systems and leverage seemingly small flaws in memory management (like pipes and page caches) to achieve total system compromise.

Disclaimer

This project and its code are intended for educational and research purposes only. Do not attempt to use this exploit on any system for which you do not have explicit, authorized permission.