Dirty Pipe (CVE-2022-0847).

A Linux kernel flaw that lets an unprivileged process overwrite the contents of arbitrary read-only files, including SUID binaries, leading to root. It belongs to the Vulnerabilities category of cybersecurity.

A Linux kernel flaw that lets an unprivileged process overwrite the contents of arbitrary read-only files, including SUID binaries, leading to root.

Dirty Pipe is a vulnerability in the Linux kernel pipe subsystem disclosed by Max Kellermann in March 2022 and tracked as CVE-2022-0847. It affects kernels 5.8 and later, including widely deployed Debian, Ubuntu and Android builds. The bug stems from an uninitialized PIPE_BUF_FLAG_CAN_MERGE flag in pipe buffer handling, which allows splicing page cache pages into a pipe and then overwriting them, even when the underlying file is read-only or owned by root. Working exploits include modifying /etc/passwd or hijacking SUID binaries such as su to gain root. Mitigation is upgrading to a patched kernel.

Defences for Dirty Pipe (CVE-2022-0847) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CVE-2022-0847.