The Dirty Pipe Vulnerability

The Dirty Pipe Vulnerability, identified as CVE-2022-0847, affects the Linux kernel versions since 5.8, allowing unauthorized processes to overwrite data in read-only files, leading to privilege escalation. Resembling the "Dirty Cow" vulnerability, it was easier to exploit and was fixed in Linux versions 5.16.11, 5.15.25, and 5.10.102. The issue was initially noticed through corrupt log files, with a recurring pattern of CRC errors. Investigation revealed a systematic corruption related to ZIP file headers, ultimately traced back to a kernel bug in Linux 5.10. The bug was reproduced by simulating data transfer between processes using C programs, leading to the identification of the faulty commit. The vulnerability stemmed from changes in the pipe buffer code, impacting the efficiency of data transfer mechanisms like splice(). This incident highlights the complexity of kernel development and the intricate interactions between software components in a system.