CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability

CVE-2022-0847 is an improper initialization flaw in the Linux kernel that lets an unprivileged local user escalate privileges on the system. It is widely known by the moniker Dirty Pipe. Because the kernel underpins nearly every Linux host, a successful local privilege escalation can turn a foothold into full system control, making timely identification and remediation essential for IT and security teams.

How it works

The weakness is classified as CWE-665, improper initialization. In broad terms for this class of kernel defect, a data structure or buffer is not correctly set up before use. An attacker who already has unprivileged local access can abuse that incomplete initialization to influence kernel memory in ways that grant higher privileges. Exact exploit mechanics and preconditions must be confirmed against the vendor advisory; public technical write-ups describe the issue at a high level as allowing unauthorized writes that lead to privilege gain. No remote unauthenticated path is indicated in the supplied facts—access must already be local.

Am I affected? How to find it in your systems

The vulnerability affects the Linux kernel, which runs on servers, workstations, containers, cloud instances, embedded devices, and many network appliances. Inventory every Linux-based system in your environment:

• Enumerate kernel versions with standard commands such as uname -r or by reading /proc/version on each host or image.
• Cross-check the running kernel (and any custom or vendor-supplied builds) against the fixed versions listed in your distribution or hardware vendor’s advisory for CVE-2022-0847.
• Include container hosts, Kubernetes nodes, golden images, and long-lived appliances; the kernel is shared by containers, so a vulnerable host kernel exposes all workloads on that host.
• Review configuration management and vulnerability-scanner results for kernel package names and versions that predate the vendor fix.

Telemetry signs of exploitation are those typical of local privilege-escalation activity: unexpected setuid binaries, sudden root-owned processes spawned by unprivileged users, anomalous writes to sensitive files, or kernel logs showing unusual pipe or splice-related activity. Because specifics vary, treat any unexplained privilege gain on a still-vulnerable kernel as potentially related and investigate promptly. Confirm exact indicators against the vendor advisory and your own baseline.

How to remediate

Patch first. Apply the kernel updates provided by your Linux distribution or hardware vendor exactly as directed in their advisory for CVE-2022-0847. CISA’s required action is to apply updates per vendor instructions. After installing the updated kernel package, reboot into the new kernel and verify the running version. Rebuild or refresh any custom kernel modules, initramfs images, and container host images so that no stale vulnerable kernels remain. Once patched, re-scan the estate to confirm the CVE no longer appears.

For hardening beyond the patch, enforce least privilege for local accounts, restrict who can obtain shells on critical hosts, and keep kernel live-patching solutions current if you rely on them between full reboots. These steps reduce the chance that an unprivileged user can reach the vulnerable code path in the first place.

If you can't patch immediately

When an immediate reboot or vendor update is not feasible, apply compensating controls while you schedule the patch:

• Segment vulnerable hosts so that only necessary administrative and service accounts can reach them; limit interactive local logins.
• Use mandatory access controls (SELinux, AppArmor, or equivalent) and seccomp profiles to constrain what unprivileged processes may do.
• Disable or tightly restrict features that unprivileged users do not require, following guidance in the vendor advisory if any such mitigations are listed.
• Increase monitoring for privilege-escalation indicators—process ancestry, unexpected capability changes, and modifications to sensitive system files—and alert on deviations.
• Virtual patching or host-based intrusion-prevention rules may offer partial coverage for known patterns, but they are not a substitute for the kernel update; confirm any such signatures against vendor or trusted security-provider guidance.

Treat these measures as temporary. Schedule the official kernel update as soon as operational constraints allow.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities can lead to full host compromise and subsequent data theft or ransomware deployment, although ransomware use specifically tied to this CVE is not documented in the supplied facts. If you have evidence of exploitation or cannot rule it out, follow your incident-response process: isolate affected systems, preserve volatile evidence, rotate credentials, and assess what data the elevated privileges could have reached. As a simple additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether associated credentials or personal information have appeared in prior incidents.