Researchers Warn of Linux Kernel ‘Dirty Pipe’ Arbitrary File Overwrite Vulnerability

Linux distributions are in the procedure of issuing patches to deal with a freshly disclosed security vulnerability in the kernel that could allow an attacker to overwrite arbitrary facts into any read through-only documents and allow for for a full takeover of afflicted techniques.

Dubbed “Filthy Pipe” (CVE-2022-0847, CVSS score: 7.8) by IONOS computer software developer Max Kellermann, the flaw “qualified prospects to privilege escalation due to the fact unprivileged procedures can inject code into root procedures.”

Kellerman claimed the bug was uncovered immediately after digging into a assist issue lifted by 1 of the clients of the cloud and hosting provider that anxious a circumstance of a “surprising sort of corruption” affecting web server access logs.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The Linux kernel flaw is claimed to have existed since model 5.8, with the vulnerability sharing similarities to that of Dirty Cow (CVE-2016-5195), which arrived to mild in Oct 2016.

“A flaw was located in the way the ‘flags’ member of the new pipe buffer composition was lacking good initialization in duplicate_webpage_to_iter_pipe and push_pipe features in the Linux kernel and could therefore comprise stale values,” Red Hat described in an advisory revealed Monday.

“An unprivileged neighborhood person could use this flaw to produce to pages in the webpage cache backed by read through only files and as this kind of escalate their privileges on the system,” it included.

Pipe, brief for pipeline, is a unidirectional inter-course of action interaction mechanism in which a established of procedures are chained jointly this kind of that just about every course of action will take input from the prior method and produces output for the next process.

Exploiting the weak spot demands doing the adhering to actions: Develop a pipe, fill the pipe with arbitrary details, drain the pipe, splice facts from the goal study-only file, and create arbitrary data into the pipe, Kellerman outlined in a evidence-of-thought (PoC) exploit demonstrating the flaw.

Put simply just the vulnerability is significant risk in that it lets an attacker to accomplish a quantity of malicious actions on the process, together with tampering with delicate files this sort of as /and so on/passwd to take away a root user’s password, incorporating SSH keys for remote accessibility, and even executing arbitrary binaries with the best privileges.

“To make this vulnerability much more appealing, it not only is effective without having produce permissions, it also is effective with immutable files, on read through-only btrfs snapshots and on go through-only mounts (including CD-ROM mounts),” the researcher claimed. “That is due to the fact the website page cache is generally writable (by the kernel), and producing to a pipe never ever checks any permissions.”

The issue has been preset in Linux variations 5.16.11, 5.15.25, and 5.10.102 as of February 23, 2022, three times right after it was described to the Linux kernel security group. Google, for its aspect, has merged the fixes into the Android kernel on February 24, 2022.

Presented the relieve with which the security flaw can be exploited and the launch of the PoC exploit, it’s encouraged that end users update Linux servers straight away and implement the patches for other distros as before long as they are obtainable.

Observed this report appealing? Abide by THN on Facebook, Twitter  and LinkedIn to read a lot more exceptional articles we post.