CVE-2022-0847 - Dirty Pipe Exploit

A proof-of-concept exploit for CVE-2022-0847 (Dirty Pipe), a Linux kernel vulnerability that allows unprivileged users to write to read-only files.

Vulnerability Details

CVE-2022-0847 affects Linux kernels 5.8 through 5.16. It exploits a race condition in the Linux kernel's pipe implementation to write arbitrary data to read-only file pages that are cached in memory.

Impact

• Privilege escalation (modifying /etc/passwd)
• Overwriting system files
• Injecting malicious code into read-only executables
• Complete system compromise on vulnerable kernels

Project Structure

.
├── src/
│   └── exploit.c          # Dirty Pipe exploit source code
├── run.sh                  # QEMU test environment launcher
├── initramfs/              # Root filesystem for testing
├── debugfs.cpio            # Compressed initramfs
└── README.md               # This file

Building the Exploit

Prerequisites

• GCC compiler
• libelf-dev (for kernel building)
• QEMU (optional, for testing)
• Linux 5.10.1 kernel sources (included in setup)

Compile

gcc ./src/exploit.c -o ./src/exploit -static -pthread

Running the Exploit

In QEMU Test Environment

./run.sh
# Inside QEMU shell:
/home/exploit
cat /etc/passwd  # Verify password hash was written
su root          # Switch to root (no password needed after exploit)

On Vulnerable System (Linux 5.8-5.16)

./src/exploit

The exploit modifies /etc/passwd to inject a root user with a known password hash.

Technical Details

The exploit works by:

1. Creating a pipe and filling it with data to set PIPE_BUF_FLAG_CAN_MERGE flags
2. Using splice() to connect a file page to the pipe buffer
3. Writing to the pipe which merges data into the file page
4. Bypassing write protection by exploiting the race condition

This allows writing to read-only memory pages without triggering COW (Copy-on-Write).

Testing Environment

• Kernel: Linux 5.10.1
• Busybox: 1.36.0
• Emulator: QEMU x86_64

Mitigation

• Update Linux kernel to version 5.17 or later
• Apply backported patches for affected versions
• Restrict access to /proc/self/mem if possible

References

• CVE-2022-0847 NVD
• Original POC
• Dirty Pipe Technical Analysis

Disclaimer

This exploit is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal.

Author

Minh Vu ([email protected])