CVE-2022-0847 PoC — Linux kernel 安全漏洞

Source

https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit

Associated Vulnerability

Title:Linux kernel 安全漏洞 (CVE-2022-0847)
Description:A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Description

A root exploit for CVE-2022-0847 (Dirty Pipe)

Readme

# What is this

This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell.

**Side Note:** I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely a small modification of Kellermann's proof of concept to enable quick/easy exploitation. Please read the original article on this extremely interesting vulnerability @ https://dirtypipe.cm4all.com/ when you get the opportunity. It really does deserve your time to understand it.

# How to use this

1. Compile with `./compile.sh` (assumes `gcc` is installed)
2. Run `./exploit` and it'll pop a root shell

# su: must be run from a terminal

If you get this error message:
1. Login as `root` with the password `aaron`.
2. Then, restore `/etc/passwd` by running `mv /tmp/passwd.bak /etc/passwd`

(oops sorry my laptop battery is dying and my charger broke so I don't have time to fix this the right now, sorry)

File Snapshot


 [4.0K]  /data/pocs/a95e44de27eebaa891316eaedab16f6d589a3f45
├── [  37]  compile.sh
├── [5.2K]  exploit.c
├── [ 16K]  LICENSE.txt
└── [1016]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!