As cited
Copy frozen at (site build).
vulnerabilities
Detecting and responding to Dirty Pipe with Elastic
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Detecting and responding to Dirty Pipe with Elastic
CVE-2022-0847 (Dirty Pipe) is a local privilege escalation vulnerability affecting Linux kernels 5.8 through 5.16.10, 5.15.24, and 5.10.101 that exploits improper initialization of pipe buffer flags to write data into read-only files. Multiple proof-of-concept exploits are publicly available and allow attackers to escalate privileges by overwriting files like /etc/passwd or injecting code into SUID binaries. Elastic provides detection logic, Auditd rules, and query examples to identify both vulnerable systems and active exploitation attempts using its security platform.
Why it matters: Linux system administrators running affected kernel versions face immediate risk of privilege escalation attacks; deploy the provided Auditd rules and detection queries to identify compromised systems and vulnerable endpoints in your environment.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Detecting and responding to Dirty Pipe with Elastic
CVE-2022-0847 (Dirty Pipe) is a local privilege escalation vulnerability affecting Linux kernels 5.8 through 5.16.10, 5.15.24, and 5.10.101 that exploits improper initialization of pipe buffer flags to write data into read-only files. Multiple proof-of-concept exploits are publicly available and allow attackers to escalate privileges by overwriting files like /etc/passwd or injecting code into SUID binaries. Elastic provides detection logic, Auditd rules, and query examples to identify both vulnerable systems and active exploitation attempts using its security platform.
Why it matters: Linux system administrators running affected kernel versions face immediate risk of privilege escalation attacks; deploy the provided Auditd rules and detection queries to identify compromised systems and vulnerable endpoints in your environment.
- Source published
- First seen by Cybersecurity Tracker