CVE-2022-0847: Dirty Pipe
A Linux kernel vulnerability in the pipe buffer implementation: a flag that marks pipe buffer pages as mergeable is never reset when a new pipe buffer is initialized, so a local attacker can use pipe splicing to overwrite the contents of arbitrary read-only files, including files they do not have write permission to, by chaining it onto the page cache.
View the authoritative record on NVD ↗Affected software
- Linux kernel 5.8 through 5.16.10 (fixed in 5.16.11, 5.15.25, 5.10.102)
How it's exploited
Create a pipe, fill it with data using splice() so its buffers are flagged as mergeable, drain it, then vmsplice() a target read-only file's page cache into the pipe; because the mergeable flag was never cleared, a subsequent write into the pipe lands directly in the file's page cache, overwriting file contents that should be immutable to that user.
Severity
CVE-2022-0847 carries a CVSS 3.1 base score of 7.8, rated High. See how CVSS scoring works or score a vulnerability yourself with the free CVSS calculator.
Weakness type
CVE-2022-0847 is categorized under CWE-665, the general weakness pattern behind this specific vulnerability.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Remediation
Upgrade to a kernel version 5.16.11, 5.15.25, or 5.10.102 or later; there is no configuration-only workaround.
Frequently asked questions
What is CVE-2022-0847?
A Linux kernel vulnerability in the pipe buffer implementation: a flag that marks pipe buffer pages as mergeable is never reset when a new pipe buffer is initialized, so a local attacker can use pipe splicing to overwrite the contents of arbitrary read-only files, including files they do not have write permission to, by chaining it onto the page cache.
How severe is CVE-2022-0847?
CVE-2022-0847 has a CVSS 3.1 base score of 7.8 out of 10, rated High.
What software is affected by CVE-2022-0847?
CVE-2022-0847 affects Linux kernel 5.8 through 5.16.10 (fixed in 5.16.11, 5.15.25, 5.10.102).
How do you fix CVE-2022-0847?
Upgrade to a kernel version 5.16.11, 5.15.25, or 5.10.102 or later; there is no configuration-only workaround.
Where is the authoritative record for CVE-2022-0847?
The National Vulnerability Database (NVD) publishes the authoritative record for CVE-2022-0847 at https://nvd.nist.gov/vuln/detail/CVE-2022-0847, including the current CVSS score, CWE mapping, and affected-configuration data.
Related CVEs
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find known-vulnerable services before an attacker does
TurboPentest fingerprints every open port and web service, then matches detected versions against known CVEs automatically, from $99 per target.
Start a pentest