Intel

CVE-2022-0847

Linux Kernel — Linux Kernel Privilege Escalation Vulnerability

criticalKEV: actively exploitedPoCEPSS 90%

Description

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Source: CISA_KEVNVDCVEORGOSVCVELISTV5SIEMENS_ADVISORY

Response & Mitigation

Why act now?

Prioritisation rationale

With an EPSS score of 89.72 % (99.8th percentile), CVE-2022-0847 has one of the highest empirical exploitation probabilities in the KEV catalogue — reliable public exploit code has been available since March 2022 and requires no specialised knowledge to operate. The CVSS vector AV:L/AC:L/PR:L/UI:N means any authenticated local user, including unprivileged service accounts, CI/CD pipeline agents, or container workloads, can achieve root without user interaction or complex preconditions. Organisations running shared Linux infrastructure, container platforms (Kubernetes, Docker), or Android device fleets in BYOD or MDM programmes face the broadest exposure. Although CISA has not flagged known ransomware campaign use, the vulnerability is a highly effective enabler for privilege escalation within multi-stage intrusions and should be treated as P1 in any NIS2-regulated environment — particularly where lateral movement from a compromised low-privilege account could reach critical systems.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the kernel patch (top priority): Update to Linux kernel 5.16.11, 5.15.25, or 5.10.102 — the first releases containing the CVE-2022-0847 fix. Distribution-specific packages: RHEL/CentOS via the relevant kernel errata advisory, Ubuntu via USN-5317-1, Debian via DSA-5095-1. Confirm the running kernel with uname -r after reboot.
  • Android devices: Apply the March 2022 Android Security Patch Level or later; affected kernels are Linux 5.8 and above as shipped in Android. Devices without an available patch must be isolated from corporate networks immediately.
  • Identify highest-risk multi-user systems first: Systems with interactive shell access for non-privileged users — shared hosting, CI/CD runners, developer workstations, container hosts — carry the greatest exposure and should be patched or isolated before all others.
  • Harden container environments: On unpatched hosts, Dirty Pipe enables container escapes. Until the patch is applied, enforce --security-opt no-new-privileges on all containers and disable privileged containers entirely.
  • Check for active exploitation: Run ausearch -k privesc (auditd) or query EDR telemetry for unexpected SUID process executions and write operations against read-only files on all affected hosts (see Detection rules for specifics).
  • Rotate credentials on exposed systems: Any system with interactive non-root users that was unpatched should be treated as potentially compromised — rotate SSH keys, service-account passwords, and any secrets accessible from those accounts.

Runbook · Step 2

Mitigation layers

  • Restrict interactive access: Because this is a local privilege escalation, the prerequisite is an authenticated shell session. Harden sshd_config with AllowUsers/AllowGroups, enforce jump-host architecture, and disable password-based SSH authentication.
  • Least-privilege process hardening: Configure systemd units with NoNewPrivileges=yes, CapabilityBoundingSet, and SecureBits. For Kubernetes, enforce the restricted PodSecurityAdmission profile across all namespaces.
  • Reduce SUID/SGID attack surface: Run find / -perm /6000 -type f and remove unnecessary SUID bits (chmod u-s). Dirty Pipe can overwrite SUID binaries in the page cache, so minimising the SUID binary set directly reduces exploitability.
  • Kernel hardening (short-term): sysctl -w kernel.unprivileged_userns_clone=0 (where supported by the distribution) reduces related attack surface but does not remediate Dirty Pipe — treat it as a defence-in-depth measure only, not a substitute for patching.
  • EDR blocklist for known PoC binaries: Add hashes of publicly available Dirty Pipe exploit binaries to EDR deny-lists. Network-layer IDS/IPS cannot block this exploit directly as it executes locally — endpoint controls are the effective layer here.
  • Immutable mounts for critical files: Place sensitive configuration files and binaries on read-only filesystems (ro mount option) or apply chattr +i to make them immutable, raising the bar for page-cache write exploitation.

Runbook · Step 3

Detection rules

  • auditd — writes to read-only files: Deploy auditctl -a always,exit -F arch=b64 -S write -F success=1 and correlate successful write syscalls against files opened O_RDONLY. Unexpected writes to /etc/passwd, /etc/shadow, or SUID binaries are high-confidence indicators.
  • Sysmon for Linux (EID 11 FileCreate / EID 1 ProcessCreate): Alert on low-UID processes generating write events against /etc/passwd or /bin/*, followed by a child process with UID 0 from the same parent — Sigma shape: EventID: 1 | filter: User != 'root' AND CommandLine contains '/etc/passwd'.
  • EDR process-ancestry chain: Shell processes (bash, sh, dash) running as non-root that directly spawn a child process with UID 0 without an intervening sudo or su call — this is the canonical post-exploitation pattern for Dirty Pipe.
  • KQL (Microsoft Sentinel / Defender for Endpoint): DeviceProcessEvents | where InitiatingProcessAccountSid !contains "S-1-5-18" and AccountSid contains "S-1-5-18" and InitiatingProcessFileName in~ ("bash","sh","python3") — surfaces SYSTEM-context processes spawned from unprivileged shells.
  • File Integrity Monitoring: Configure AIDE or Wazuh FIM to watch /etc/passwd, /etc/shadow, /etc/sudoers, and all SUID binaries. Any change outside a defined maintenance window should trigger an immediate alert.

Metrics

Severity
critical
Priority score
200.15
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
7.8
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
89.7 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-04-25 00:00 UTC
CWE
CWE-665

Weakness classes (CWE)

  • CWE-665Class

    Improper Initialization

    The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

    cwe.mitre.org →

Affected operating systems

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux_eus8.2

  • linux

    redhat / enterprise_linux_eus8.4

  • linux

    redhat / enterprise_linux_for_ibm_z_systems8.0

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus8.2

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus8.4

  • linux

    redhat / enterprise_linux_for_power_little_endian8.0

  • linux

    redhat / enterprise_linux_for_power_little_endian_eus8.2

  • linux

    redhat / enterprise_linux_for_power_little_endian_eus8.4

  • linux

    redhat / enterprise_linux_for_real_time8

  • linux

    redhat / enterprise_linux_for_real_time_for_nfv8

  • linux

    redhat / enterprise_linux_for_real_time_for_nfv_tus8.2

  • linux

    redhat / enterprise_linux_for_real_time_for_nfv_tus8.4

  • linux

    redhat / enterprise_linux_for_real_time_tus8.2

  • linux

    redhat / enterprise_linux_for_real_time_tus8.4

  • linux

    redhat / enterprise_linux_server_aus8.2

  • linux

    redhat / enterprise_linux_server_aus8.4

  • linux

    redhat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.1

  • linux

    redhat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.2

  • linux

    redhat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.4

  • linux

    redhat / enterprise_linux_server_tus8.2

  • linux

    redhat / enterprise_linux_server_tus8.4

  • linux

    redhat / enterprise_linux_server_update_services_for_sap_solutions8.1

  • linux

    redhat / enterprise_linux_server_update_services_for_sap_solutions8.2

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • android

    :linux_kernel::0

  • android

    :linux_kernel:Kernel

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2022-0847
Linux Kernel — Linux Kernel Privilege Escalation Vulnerability — CVE-2022-0847 | NEOSEC Intel