SUSE statement on “Dirty Pipe” attack

On Monday, March 7th, security researcher Max Kellermann published a new software vulnerability that affect users of the Linux Kernel.

The vulnerability, called Dirty Pipe (CVE-2022-0847) , impacts Linux Kernels 5.8 and later, and allows local attackers to overwrite files even if they had only read permissions, allowing for easy privilege escalation.

The issue is triggered by a combination of two bugs, one bug in Linux Kernels 4.9 and newer and made exploitable by the second bug introduced in Linux Kernel 5.8.

Our currently maintained SUSE Linux Enterprise products are not affected as they ship older Linux Kernels than 5.8. The upcoming SUSE Linux Enterprise 15 SP4 with Linux kernel 5.14 will be already fixed before shipment.

We will still release fixes for the first bug for SUSE Linux Enterprise 12 SP4 and newer and SUSE Linux Enterprise 15 and newer, even though they are not directly affected:

• SUSE TID 000020603
• SUSE CVE Page for CVE-2022-0847
• Researcher URL (external)

If you have any questions or concerns, please reach out to your SUSE contact. Security and reliability continue to be top priorities for SUSE because they are top priorities for our customers and partners. And as always, customers and partners come first.