2026-07-18 05:09:22 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： CVE-2022-0847DirtyPipe漏洞利用Linux内核pipebuffer结构体中flags字段未正确初始化的缺陷，通过splice()将文件页缓存引入管道后，残留的PIPEBUFFLAGCAN_MERGE标志允许后续write()直接写入该页缓存，从而绕过文件权限检查修改任意只读文件内容。该漏洞影响范围广，建议及时更新内核以修复此高危提权漏洞。 综合评分： 95 文章分类： 漏洞分析,二进制安全

cover_image

CVE-2022-0847 Dirty Pipe 漏洞原理深度分析

4seaynl 4seaynl

看雪学苑

2026年7月17日 18:06 上海

在小说阅读器读本章

去阅读

一、漏洞核心原理概述

这个漏洞的本质是：pipe_buffer 结构体中的 `flags` 字段未被正确初始化，导致通过 `splice()` 从文件引入的页面缓存（page cache）被错误地标记为”可合并写入”（`PIPE_BUF_FLAG_CAN_MERGE`），从而允许后续的 `write()` 直接写入该页面缓存，修改任意只读文件的内容。

#

二、关键数据结构

// 内核中的 pipe_buffer 结构体
struct&nbsp;pipe_buffer&nbsp;{
struct&nbsp;page&nbsp;*page; &nbsp; &nbsp; &nbsp;// 指向内存页
unsignedint&nbsp;offset; &nbsp; &nbsp;// 页内偏移
unsignedint&nbsp;len; &nbsp; &nbsp; &nbsp;&nbsp;// 数据长度
conststruct&nbsp;pipe_buf_operations&nbsp;*ops;
unsignedint&nbsp;flags; &nbsp; &nbsp;&nbsp;// ← 漏洞关键字段！
unsignedlongprivate;
};

flags 中的关键标志位：
PIPE_BUF_FLAG_CAN_MERGE = 0x10

当此标志被设置时，内核认为”这个 pipe_buffer 可以追加写入数据”，而不是分配新的 buffer。

#

三、利用步骤详解

#

第一步：准备管道 — 污染 flags

#

┌─────────────────────────────────────────────────────┐
│ &nbsp;prepare_pipe(p) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;1.&nbsp;pipe(p) 创建管道 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;2.&nbsp;填满管道（写满所有 pipe_buffer） &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; ┌──────┬──────┬──────┬──────┬───────────────┐ &nbsp; &nbsp;│
│ &nbsp; &nbsp; │ buf0 │ buf1 │ buf2 │ ... │ bufN &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp;│
│ &nbsp; &nbsp; │flags=│flags=│flags=│ &nbsp; &nbsp; │flags=&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp;│
│ &nbsp; &nbsp; │MERGE&nbsp;│MERGE&nbsp;│MERGE&nbsp;│ &nbsp; &nbsp; │MERGE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp;│
│ &nbsp; &nbsp; └──────┴──────┴──────┴──────┴───────────────┘ &nbsp; &nbsp;│
│ &nbsp; &nbsp; 写入时内核自动设置 PIPE_BUF_FLAG_CAN_MERGE &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;3.&nbsp;读空管道（drain） &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp;&nbsp;-&nbsp;所有 pipe_buffer 被"释放"回环形队列 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp;&nbsp;-&nbsp;但 flags 字段&nbsp;**没有被清零**！ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp;&nbsp;-&nbsp;flags 仍然保留 PIPE_BUF_FLAG_CAN_MERGE &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;结果：管道为空，但下一个被使用的 pipe_buffer &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp;仍带有残留的 CAN_MERGE 标志 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└─────────────────────────────────────────────────────┘

第二步：splice() — 将文件页引入管道

┌─────────────────────────────────────────────────────┐
│ &nbsp;splice(fd, &offset, p[1], NULL,&nbsp;1,&nbsp;0) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;目标文件（只读打开）: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;┌────────────────────────────────────────────┐ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│&nbsp;Page&nbsp;Cache&nbsp;(内核中的文件缓存页) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ ┌──────────────────────────────────────┐ &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ │ ... [byte] [data we want to modify] ...│ &nbsp;│ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ └──────────────────────────────────────┘ &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;└────────────────────────────────────────────┘ &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;splice 执行&nbsp;copy_page_to_iter_pipe(): &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;pipe_buffer[0]&nbsp;= { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp;.page &nbsp; = 文件的 page cache 页面（引用！） &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp;.offset = offset_in_page &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp;.len &nbsp; &nbsp;=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp;.flags &nbsp;= ??? （未初始化！！！） &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;} &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;BUG: copy_page_to_iter_pipe() 没有设置 flags =&nbsp;0&nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; 因此 flags 保留了之前残留的 CAN_MERGE 值！ &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;此时管道状态： &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;┌──────────────────────────────┐ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ pipe_buffer[0] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ .page → 文件 page cache &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ .len &nbsp;=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ .flags = PIPE_BUF_FLAG_CAN_MERGE &nbsp;← 残留! &nbsp; &nbsp; &nbsp; │
│ &nbsp;└──────────────────────────────┘ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└─────────────────────────────────────────────────────┘

第三步：write() — 写入数据到页面缓存

┌─────────────────────────────────────────────────────┐
│ &nbsp;write(p[1], data, data_size) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;内核&nbsp;pipe_write() 逻辑： &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;检查最后一个 pipe_buffer: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp;if (buf->flags & PIPE_BUF_FLAG_CAN_MERGE) { &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp;// 认为可以追加写入到同一个页面 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp;// 直接 copy_from_user 到 buf->page &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp;// 而这个 page 是文件的 page cache！ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp;} &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;结果： &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;┌────────────────────────────────────────────┐ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ Page Cache（被修改！） &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ ┌──────────────────────────────────────┐ &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ │ ...&nbsp;[X][our injected data!!!]&nbsp;... &nbsp; │ &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;│ └──────────────────────────────────────┘ &nbsp; │ &nbsp; &nbsp; &nbsp;│
│ &nbsp;└────────────────────────────────────────────┘ &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;文件内容被修改！即使： &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;- 文件以 O_RDONLY 打开 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;- 文件设置了 immutable 属性 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;- 文件在只读文件系统上 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└─────────────────────────────────────────────────────┘

#

四、整体攻击流程图

#

用户空间 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 内核空间
───────── &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ─────────

1.&nbsp;pipe(p) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 分配 pipe_inode_info
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;分配 pipe_buffer 环形数组

2.&nbsp;write(p[1], junk, pipe_size) &nbsp; &nbsp;设置所有 buf->flags |= CAN_MERGE

3.&nbsp;read(p[0], buf, pipe_size) &nbsp; &nbsp; &nbsp;"释放"&nbsp;buffer，但 flags 未清零
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;flags 残留 CAN_MERGE ← BUG!

4.&nbsp;open(target, O_RDONLY) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;正常打开文件

5.&nbsp;splice(fd →&nbsp;pipe) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;copy_page_to_iter_pipe()
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;┌─ buf->page = file page cache
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;├─ buf->offset = ...
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;├─ buf->len =&nbsp;1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;└─ buf->flags = (未初始化, 残留CAN_MERGE)

6.&nbsp;write(p[1], payload) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pipe_write() 检查 CAN_MERGE
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;→ 直接写入 page cache！
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;文件内容被覆盖（在内存中）
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;脏页回写到磁盘 → 持久化修改

#

五、为什么能绕过权限检查？

#

正常写文件流程：
write() →&nbsp;vfs_write() → 权限检查(inode permission) → 实际写入

Dirty Pipe 流程：
write() →&nbsp;pipe_write() → 检查的是 pipe 的权限（可写）
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;→ 但实际写入的目标是 page cache
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;→ 绕过文件权限检查

关键点：内核只检查了"能不能往 pipe 里写"
&nbsp; &nbsp; &nbsp; &nbsp;没有检查"pipe_buffer 引用的 page 是否允许写入"

#

六、利用限制

#

限制1: 偏移不能在页边界上（offset % 4096 != 0） 0x1000
原因: splice 必须先读取 1 字节来建立页面引用
&nbsp; &nbsp; &nbsp; 如果 offset=0，没有"前一字节"可以 splice

限制2: 写入不能跨页
原因: CAN_MERGE 只允许在同一个 page 内追加
&nbsp; &nbsp; &nbsp; 跨页需要新的 pipe_buffer（不带 CAN_MERGE）

限制3: 不能扩大文件
原因: page cache 只存在于文件已有大小范围内

#

七、修复补丁

#

// 修复方式极其简单 — 初始化 flags 字段

// lib/iov_iter.c - copy_page_to_iter_pipe()
// 修复前：
buf->ops = &page_cache_pipe_buf_ops;
buf->page = page;
buf->offset = offset;
buf->len = bytes;
// flags 未设置！

// 修复后：
buf->ops = &page_cache_pipe_buf_ops;
buf->flags =&nbsp;0; &nbsp;// ← 新增这一行！
buf->page = page;
buf->offset = offset;
buf->len = bytes;

补丁commit: 9d2231c5d74e (Linux 5.16.11, 5.15.25, 5.10.102)

#

八、实际利用场景

#

场景1: 覆盖 /etc/passwd
&nbsp; 将 root 用户的密码哈希替换为已知密码 → 直接 su root

场景2: 覆盖 /root/.ssh/authorized_keys（如 PoC 所示）
&nbsp; 注入攻击者的 SSH 公钥

场景3: 覆盖 SUID 二进制文件
&nbsp; 修改 /usr/bin/su 等 SUID 程序的代码段 → 执行任意代码

场景4: 容器逃逸
&nbsp; 容器内修改宿主机文件（通过挂载的卷）

#

九、为什么这个漏洞如此危险

#

这是近年来最”干净”的内核提权漏洞之一 — 无需绕过任何保护机制，一次成功，无副作用。

#

看雪ID：4seaynl

https://bbs.kanxue.com/user-home-909875.htm

*本文为看雪论坛优秀文章，由 4seaynl 原创，转载请注明来自看雪社区

第十届安全开发者峰会【议题征集】-欢迎投稿

往期推荐

Android ARM64 内核态内存访问与隐蔽交互机制逆向分析

电动牙刷小程序”越权控制”逆向

一道简单但不简约的堆题——CISCN2026初赛堆题robo分析

第二届软件系统安全赛决赛 StudentManagement 详解

APP整体加固原理

球分享

球点赞

球在看

点击阅读原文查看更多

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：看雪学苑 4seaynl 4seaynl《CVE-2022-0847 Dirty Pipe 漏洞原理深度分析》