CVE-2022-0847

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.8 through 5.16.10

Description An issue exists in the Linux kernel where the flags member of the new pipe buffer structure is not properly initialized within the copy page to iter pipe() and push pipe() functions. This lack of initialization can lead to the presence of stale values, allowing an unprivileged local user to overwrite data in the page cache of arbitrary read-only files, such as /etc/passwd. This can be used to inject code from unprivileged processes into privileged ones, resulting in privilege escalation and the acquisition of an elevated shell. Real-world incidents have shown this flaw being used to escalate privileges followed by the use of Discord for command-and-control communications.

Recommendations Update the Linux kernel to version 5.16.11 or later.