{"uuid": "ac5e3fac-01f1-4f80-a42a-31a276be08f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0847", "type": "seen", "source": "https://t.me/hacking_Attack/45476", "content": "Black Hat Ethical Hacking\nNew Linux bug gives root on all major distros, exploit released\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Linux bug gives root on all major distros, exploit releasedPost Views: 2 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nA new Linux vulnerability known as \u2018Dirty Pipe\u2019 allows local users to gain root privileges through publicly available exploits.\nToday, security researcher Max Kellermann responsibly disclosed the \u2018Dirty Pipe\u2019 vulnerability and stated that it affects Linux Kernel 5.8 and later versions, even on Android devices.\n\nThe vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root.\n\nKellerman discovered the bug after tracking down a bug that was corrupting web server access logs for one of his customers.\n\nKellerman states that the vulnerability is similar to the Dirty COW vulnerability\u00a0(CVE-2016-5195) fixed in 2016.\nSee Also: Complete Offensive Security and Ethical Hacking Course Public exploits give root privileges As part of the Dirty Pipe disclosure, Kellerman released a proof-of-concept (PoC) exploit that allows local users to inject their own data into sensitive read-only files, removing restrictions or modifying configurations to provide greater access than they usually would have.\n\nFor example, security researcher Phith0n\u00a0illustrated how they could use the exploit to modify the /etc/passwd file so that the root user does not have a password. Once this change is made, the non-privileged user could simply execute the \u2018su root\u2018 command to gain access to the root account.\nWhy did I overwrite the /etc/passwd?\nBecause this file saves all the user information on Linux.\nI remove the \"x\" flag behind the \"root\" user, it means that I set an empty password for this user. So I can use \"su root\" to escalate privilege without credentials.\n\n\u2014 Phith0n (@phithon_xg) March 7, 2022\nHowever, an updated exploit by security researcher BLASTY\u00a0was also publicly released today that makes it even easier to gain root privileges\u00a0by patching the /usr/bin/su command to drop a root shell at /tmp/sh and then executing the script.\n\nOnce executed, the user gains root privileges, as demonstrated by BleepingComputer below in Ubuntu 20.04.3 LTS running the 5.13.0-27-generic kernel.\nhttps://www.bleepstatic.com/images/news/security/attacks/l/linux/dirtypipe/dirtypipe-poc.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:52.762061Z"}