Dirty Pipe CVE-2022-0847 (Linux kernel pipe flaw lets an unprivileged user overwrite read-only files and escalate to root, CISA KEV): which kernel versions are fixed and how do I check my systems?

What it is: CVE-2022-0847, called Dirty Pipe, is a Linux kernel bug where the flags of a new pipe buffer weren't properly initialized. An unprivileged local user could write into the page cache of files they may only read, including files owned by root, and use that to inject code into root processes and get root. It was found by Max Kellermann (CM4all) while investigating corrupted log files, reported in February 2022, fixed in stable kernels on 2022-02-23 and disclosed on 2022-03-07. The researcher noted it is similar to Dirty COW (CVE-2016-5195) but easier to exploit, and it also affected Android (reproduced on a Pixel 6). CISA added it to the Known Exploited Vulnerabilities catalog on 2022-04-25. Am I affected: - Linux kernels from 5.8 up to the fixed versions: 5.16.11, 5.15.25 and 5.10.102 fixed it for those stable lines. Distribution kernels carry their own version numbers, so check your distribution's advisory for CVE-2022-0847 rather than comparing numbers directly. - Check: uname -r for the running kernel (not just what's installed), and your distribution's security tracker. - Android devices depend on the vendor's security patch level. Fix: 1. Install your distribution's updated kernel and reboot into it (or use your live-patching service if it covers this CVE). A new kernel package doesn't protect you until the machine runs it. 2. For appliances, embedded devices and Android phones, apply the vendor's firmware or security update. 3. Since this needs local code execution, limit who and what can run code on the machine (untrusted users, CI jobs, containers running untrusted workloads share the host kernel). Verify: uname -r shows a fixed kernel from your distribution (or 5.16.11 / 5.15.25 / 5.10.102 or later for mainline stable kernels), and your vulnerability scanner no longer reports CVE-2022-0847. Sources: https://dirtypipe.cm4all.com/ https://bugzilla.redhat.com/show_bug.cgi?id=2060795 https://nvd.nist.gov/vuln/detail/CVE-2022-0847 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0847