https://www.theregister.com/2022/03/08/in_brief_security/
"A Linux local privilege escalation flaw dubbed Dirty Pipe has been
discovered and disclosed along with proof-of-concept exploit code."
"The flaw, CVE-2022-0847, was introduced in kernel version 5.8 and fixed
in versions 5.16.11, 5.15.25, and 5.10.102."
Apparently affects certain (recent) Android devices in a _BAD_ way
<quote>
The bug can be abused to add or overwrite data in sensitive read-only
files, such as removing the root password from /etc/passwd allowing
anyone on the system to get superuser access, or temporarily altering a
setuid binary to grant root privileges.
The bug is pretty fascinating: a screw-up during a refactoring of the
kernel's pipe handling code opens the door for allowing a user program
to overwrite the contents of the page cache, which eventually makes its
way into the file system. It's similar to Dirty COW, and easier to exploit. </quote>
I did a quick bit of research, and it looks like the 5.8 kernel was
released around August of 2020.
https://www.omgubuntu.co.uk/2020/08/linux-5-8-kernel-features
It also looks like RPi devices using an older Raspbian from 2020, the
first version to support the RPi 4, are OK as that version of Raspbian
is using a 4.19 kernel and is therefore unaffected. Not sure about the
newer RPi kernels, though... (the Raspberry Pi OS, which replaced
Raspbian that same year, apparently used a 5.4 LTS kernel)
HOWEVER: When I visited raspberrypi/linux over on github, I saw the
default branch with a label that suggested it was the 5.15 kernel, which
would be affected. Whether or not a kernel version since 5.8 is in any
of the binary images for RPi, I do not know for certain.
So it would looks as if Linux devices running a more "bleeding edge"
version of the Linux kernel, including some newer Android devices, are
the ones affected by this flaw. If you're like me and run really
ancient stuff becauase you're too cheap to pay $1000 for a phone or
simply do NOT HAVE THE MONEY, it looks like you may have been SPARED the
fate of having a Linux vulnerability like this waiting to be exploited...
--
(aka 'Bombastic Bob' in case you wondered)
'Feeling with my fingers, and thinking with my brain' - me
'your story is so touching, but it sounds just like a lie'
"Straighten up and fly right"
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)