A Linux kernel vulnerability dubbed ‘Dirty Pipe’ allows an attacker to change any file on the system – including read only files such as the password file.
The flaw affects Linux Kernel 5.8 and later – including Android devices as well as mainstream Linux server distros.
Tracked as CVE-2022-0847, the flaw in the way memory cache is managed when writing to pipes could be exploited to alter the content of read only files which reside in cache memory (such as removing the password for the root user in the password file) but the change would be reverted when the system is rebooted – removing all trace of the manipulation.
The story of how the vulnerability was discovered is documented in the researchers blog, along with proof of concept code.
Fixes for the vulnerability in the Linux kernel (5.16.11, 5.15.25, 5.10.102) were released on February 23 and Google published a bug fix into the Android kernel on February 24.
Since proof of concept code has now been made public, it is more likely that threat actors will attempt to exploit this vulnerability on unpatched systems.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)