## https://sploitus.com/exploit?id=50E2D1FB-358D-5085-A24B-3CCD7339B7FE
# CVE-2022-0847 - Dirty Pipe Exploit
A proof-of-concept exploit for CVE-2022-0847 (Dirty Pipe), a Linux kernel vulnerability that allows unprivileged users to write to read-only files.
## Vulnerability Details
**CVE-2022-0847** affects Linux kernels 5.8 through 5.16. It exploits a race condition in the Linux kernel's pipe implementation to write arbitrary data to read-only file pages that are cached in memory.
### Impact
- Privilege escalation (modifying `/etc/passwd`)
- Overwriting system files
- Injecting malicious code into read-only executables
- Complete system compromise on vulnerable kernels
## Project Structure
```
.
├── src/
│ └── exploit.c # Dirty Pipe exploit source code
├── run.sh # QEMU test environment launcher
├── initramfs/ # Root filesystem for testing
├── debugfs.cpio # Compressed initramfs
└── README.md # This file
```
## Building the Exploit
### Prerequisites
- GCC compiler
- `libelf-dev` (for kernel building)
- QEMU (optional, for testing)
- Linux 5.10.1 kernel sources (included in setup)
### Compile
```bash
gcc ./src/exploit.c -o ./src/exploit -static -pthread
```
## Running the Exploit
### In QEMU Test Environment
```bash
./run.sh
# Inside QEMU shell:
/home/exploit
cat /etc/passwd # Verify password hash was written
su root # Switch to root (no password needed after exploit)
```
### On Vulnerable System (Linux 5.8-5.16)
```bash
./src/exploit
```
The exploit modifies `/etc/passwd` to inject a root user with a known password hash.
## Technical Details
The exploit works by:
1. **Creating a pipe** and filling it with data to set `PIPE_BUF_FLAG_CAN_MERGE` flags
2. **Using `splice()`** to connect a file page to the pipe buffer
3. **Writing to the pipe** which merges data into the file page
4. **Bypassing write protection** by exploiting the race condition
This allows writing to read-only memory pages without triggering COW (Copy-on-Write).
## Testing Environment
- **Kernel**: Linux 5.10.1
- **Busybox**: 1.36.0
- **Emulator**: QEMU x86_64
## Mitigation
- Update Linux kernel to version 5.17 or later
- Apply backported patches for affected versions
- Restrict access to `/proc/self/mem` if possible
## References
- [CVE-2022-0847 NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-0847)
- [Original POC](https://www.datawire.io/running-an-ebpf-program-in-the-linux-kernel/)
- [Dirty Pipe Technical Analysis](https://dirtypipe.cm4all.com/)
## Disclaimer
This exploit is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal.
## Author
Minh Vu (vudangducminh@gmail.com)