Exploited in the wild · Linux kernel · CVSS 7.8 · published 10 March 2022
Dirty Pipe: CVE-2022-0847
A flaw in the kernel's pipe buffers that lets a local user overwrite data in read-only files, including setuid programs, and gain root. It affects kernels from 5.8 on. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 1end-of-life systems without a free fix
- 8fixed or not affected
Dirty Pipe on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Not affected | Red Hat security data |
| CentOS 7 | Not affected | Red Hat security data |
| RHEL 7 | Not affected | Red Hat security data |
| CentOS 8 | No free fix | Red Hat fixed it on 10 March 2022, after this release's end of life |
| Ubuntu 16.04 | Not affected | Ubuntu security tracker |
| Ubuntu 18.04 | Not affected | Ubuntu security tracker |
| Ubuntu 20.04 | Not affected | Ubuntu security tracker |
| Debian 10 | Not affected | Debian security tracker |
| Debian 11 | Fixed | 5.10.92-2, DSA-5092-1 |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
The Linux kernel versions we track
| Version | CVE-2022-0847 |
|---|---|
| Linux kernel 2.6.32 | Not affected |
| Linux kernel 3.10 | Not affected |
| Linux kernel 4.4 | Not affected |
| Linux kernel 4.14 | Not affected |
| Linux kernel 4.15 | Not affected |
| Linux kernel 4.18 | Not affected |
| Linux kernel 4.19 | Not affected |
| Linux kernel 5.4 | Not affected |
| Linux kernel 5.10 | Affected |
For the upstream version, according to the US National Vulnerability Database. A distribution package may carry its own fix; the table above shows that.
What the NVD record says
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
Score 7.8 (High), published 10 March 2022. Listed in the CISA catalogue of known exploited vulnerabilities on 25 April 2022. Read the NVD entry
Affected upstream versions of Linux kernel
- linux kernel from 5.8 before 5.10.102
- linux kernel from 5.15 before 5.15.25
- linux kernel from 5.16 before 5.16.11
What you can do
Keep Linux kernel, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.