Dirty Pipe: CVE-2022-0847 in the Linux kernel

A local user writes into read-only files through the page cache and becomes root.

Published in the NVD on 10/03/2022

CVE-2022-0847

CVSS 3.1: 7.8 (high) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 25/04/2022

Exploitation probability (EPSS, 01/11/2026): 92.795 %, percentile 99.829

What is Dirty Pipe?

Dirty Pipe is a flaw in the Linux kernel. The flags member of the new pipe buffer structure was not initialised properly in the functions copy_page_to_iter_pipe and push_pipe and could carry stale values. An unprivileged local user can use this to write into pages of the page cache that belong to read-only files, and so gain higher privileges.

The NVD rates it at CVSS 7.8, and CISA has listed it as actively exploited since 25 April 2022. The NVD lists kernels from 5.8 up to the fixed versions 5.10.102, 5.15.25 and 5.16.11.

Affected and fixed versions

Linux 5.16

Affected: 5.16 - 5.16.10

Fixed in 5.16.11

Linux 5.15

Affected: 5.15 - 5.15.24

Fixed in 5.15.25

Linux 5.10

Affected: 5.8 - 5.10.101

Fixed in 5.10.102

All branches and vulnerabilities of Linux Kernel

Status in Debian and Ubuntu

Debian 12: linux

Fixed

Fixed from package version 5.16.11-1

Debian 13: linux

Fixed

Fixed from package version 5.16.11-1

The OSV database lists no Ubuntu packages for this flaw.

What to do

Update the kernel and reboot. Debian 12 and 13 ship kernels with the fix. On Ubuntu the fixed version depends on the kernel variant; the OSV entry in the sources lists them.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch Linux Kernel

Watch linux (Debian 12)

Already have an account? Log in and add Linux Kernel