The Dirty Pipe Vulnerability

Re:The Dirty Pipe Vulnerability by jesprenj on Monday March 07, 2022 @07:44AM (#30587083)

This affects kernels from 5.8 and was fixed in 5.16.11, 5.15.25 and 5.10.102. Exploit code is public and available on the linked page.

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by baggy_trough on Monday March 07, 2022 @01:11PM (#30591243)

It's disturbing that despite prior disclosure on distro lists, Ubuntu doesn't have an update available, with public exploits circulating now.

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by greyface- on Monday March 07, 2022 @08:17AM (#30587357)

Debian stable (bullseye) is still vulnerable: https://security-tracker.debian.org/tracker/CVE-2022-0847

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by deng on Monday March 07, 2022 @08:26AM (#30587432)

That page is not up-to-date, fix was released today:

https://lists.debian.org/debian-security-announce/2022/msg00...

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by greyface- on Monday March 07, 2022 @08:29AM (#30587463)

It wasn't available via `apt-get update && apt-get dist-upgrade` as of when I drafted that comment, but I confirm that 5.10.92-2 seems to be released now.

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by deng on Monday March 07, 2022 @08:36AM (#30587537)

Well the fix was released ~30 minutes ago, so that checks out. ;-)

The security-tracker site is now updated as well.

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by bill_mcgonigle on Tuesday March 08, 2022 @02:22PM (#30605005)

Others, note that the new archive name is 'stable-security'. You might need to update your pins if you upgraded from Buster and you're not seeing the update now. I put in a pull request to add it to the release notes.

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by raesene9 on Monday March 07, 2022 @08:04AM (#30587242)

< 5.8 not being affected is probably a saving grace for quite a few enterprises as I'd expect that LTS distributions may not have got that version included as yet.

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by gchamonlive on Monday March 07, 2022 @08:15AM (#30587332)

CentOS 7 is already at 5.10 so it should affect lots of production systems

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by LinuxBender on Monday March 07, 2022 @09:58AM (#30588524)

Are you by chance using a 3rd party kernel repo such as ElRepo to work around a limitation? Or could someone at your org be compiling a custom kernel?

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by emrvb on Monday March 07, 2022 @09:43AM (#30588370)

*blinks*

*stares at kernel-3.10.0-1160.59.1.el7*

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by samus on Monday March 07, 2022 @05:39PM (#30594306)

Is this a smartphone? I'm on 3.18!

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by baggy_trough on Monday March 07, 2022 @10:01AM (#30588556)

How about Ubuntu?

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by zenexer on Monday March 07, 2022 @10:51AM (#30589206)

The relevant CVE page returns a 500 error: https://github.com/canonical-web-and-design/ubuntu.com/issue...

21.10 appears to be lacking the patch.

[ Parent | on HN ]

Re:The Dirty Pipe Vulnerability by baggy_trough on Monday March 07, 2022 @01:36PM (#30591555)

The CVE page returns now, with a whole bunch of "needs triage".

https://ubuntu.com/security/CVE-2022-0847

[ Parent | on HN ]