7.8

CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability

KEV
Analyzed
AliasesRHSA-2022:0822RHSA-2022:0831UBUNTU-CVE-2022-0847
Published 07-03-2022Last modified 21-10-2025

Vulnerability summary

CVE-2022-0847 is a high (CVSS 7.8) Improper Initialization vulnerability in Linux Kernel. It is known to be exploited: CISA lists it, first on 25-04-2022. EPSS estimates a 92.80% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 6 public exploits are recorded.

Priority
Act nowlisted as exploited

Listed as exploited by CISA (25-04-2022)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
92.80%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareNot flaggedNo ransomware use recorded.
Public exploits6reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 27 · Related 18
DSA-5092-1MGASA-2022-0092MGASA-2022-0095OPENSUSE-SU-2022:0755-1OPENSUSE-SU-2022:0760-1OPENSUSE-SU-2022:0768-1

Timeline

  1. 07-03-2022
    PublishedVulnerability first disclosed.
  2. 25-04-2022
    Added to CISA KEVExploitedLinux Kernel Privilege Escalation Vulnerability
  3. 16-05-2022
    CISA remediation dueDeadline passedApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

92.80%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 92.80% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-04-2022
Federal due date
16-05-2022
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2022-0847

Public exploits

6 found
  • referenceUnverified

    Exploit Reference (dirtypipe.cm4all.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

Show all 6 exploits
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • exploit-databaselocallinuxUnverified

    Linux Kernel 5.8 < 5.16.11 - Local Privilege Escalation (DirtyPipe)

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Dirty Pipe Local Privilege Escalation via CVE-2022-0847

    exploit/linux/local/cve_2022_0847_dirtypipe

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat65 products
Ubuntu38 products
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
  • linux-aws-5.13< 5.13.0-1017.19~20.04.1
  • linux-aws-5.3All versions (No fix recorded)
  • linux-aws-5.8All versions (No fix recorded)
Netapp8 products
Debian1 product
  • linux< 5.16.11-1
Fedoraproject1 product
Linux1 product
  • linux_kernel≥ 5.8, < 5.10.102 | ≥ 5.15, < 5.15.25 | ≥ 5.16, < 5.16.11
Ovirt1 product
Siemens1 product
Sonicwall1 product

9 vendors · 117 products

References

28 links
Show all 28 references