CVE-2022-0847 (Dirty Pipe) Exploit

Affected versions >=5.8, <5.16.11, 5.15.25 and 5.10.102

exp.c

Use this vulnerability to overwrite read-only files

exp-root-shell.c

Generate shellcode that executes /bin/sh to overwrite a SUID program owned by root, using passwd as an example. Then run the overwritten program to obtain a shell, achieving privilege escalation.

(Although the first byte of the file cannot be modified, as long as the overwritten file and the generated shellcode are both in ELF format, the first byte will necessarily be 0x7f, so there is no need to worry about this issue.)