A vulnerability was found in Linux Kernel up to 5.10.101/5.15.24/5.16.10 (Operating System) and classified as critical. This issue affects some unknown processing of the component Pipe Handler. Impacted is confidentiality, integrity, and availability.

The weakness was presented 03/08/2022. The advisory is shared at dirtypipe.cm4all.com. The identification of this vulnerability is CVE-2022-0847. Technical details are unknown but a public exploit is available.

A public exploit has been developed by Max Kellermann/BLASTY in C and been published before and not just after the advisory. The exploit is available at haxx.in. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 04/25/2022 with a due date of 05/16/2022:

Apply updates per vendor instructions.

Upgrading to version 5.10.102, 5.15.25 or 5.16.11 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at lore.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Exploit-DB (50808).

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.10.101
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9
• 5.16.10

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion