Log in Start free

Actively exploited · Published Mar 7, 2022 · Assigned by redhat

CVE-2022-0847

High 7.8 Exploited

In plain English

A high-severity security flaw in kernel. Attackers are actively exploiting it in the wild (listed by CISA on April 25, 2022). The chance it is exploited in the next 30 days is estimated at 92.8% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)92.8%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Apr 25, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 16, 2022.

Official description

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8kernel-tools-libs-devel4.18.0-348.20.1.el8_5ALSA-2022:0825
Debian:12linux5.16.11-1DEBIAN-CVE-2022-0847
Debian:13linux5.16.11-1DEBIAN-CVE-2022-0847
Debian:14linux5.16.11-1DEBIAN-CVE-2022-0847
Rocky Linux:8kernel0:4.18.0-348.20.1.el8_5RLSA-2022:0825
Rocky Linux:8kernel-rt0:4.18.0-348.20.1.rt7.150.el8_5RLSA-2022:0819

Affected products (as reported)

VendorProductVersions
n/a kernel Linux Kernel 5.17 rc6

Weakness: CWE-665 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References