Dirty Pipe Isn’t Dead: How to Find and Fix Linux Kernel Write Vulnerabilities Forever

 

Stop chasing old CVE dates. Learn to check, patch, and mitigate the Dirty Pipe-like flaw (CVE-2022-0847) on Ubuntu, Rocky Linux , SUSE. Includes a hands-on lab, automation script, and affiliate tools to lock down your Linux kernel today.

Historical context: In March 2022, a bug dubbed "Dirty Pipe" (CVE-2022-0847) shocked the Linux world. It allowed any unprivileged user to overwrite any readable file—including root-owned ones.

But here’s the truth: This type of bug isn't going away. Similar kernel write flaws appear every year. Instead of panicking over a date, learn the pattern. This guide teaches you how to detect, patch, and mitigate kernel file-overwrite vulnerabilities on any major Linux distro.

How to check if you are vulnerable

Run these commands as a normal user (no root needed for the check).

For Ubuntu 20.04 / 22.04:

bash

uname -r
# If kernel version is between 5.8 and 5.16.11, you are likely vulnerable.
# Test with a proof of concept (safe):
grep -i "pipe" /proc/buddyinfo > /dev/null && echo "Check kernel manually"

For Rocky Linux / RHEL 8/9:

bash

rpm -q kernel
# Vulnerable kernels: 4.18.0-348.el8 to 4.18.0-348.7.1.el8_5
# Check if fix is present:
sysctl -a 2>/dev/null | grep pipe

For SUSE Linux Enterprise / openSUSE Leap:

bash

zypper info kernel-default | grep Version
# Vulnerable: 5.14.21-150400.22 (and earlier for 15.3)
# Manual test (safe):
cat /proc/version

Universal test (safe, no exploit):

bash

# Check if your kernel has the patch for CVE-2022-0847
uname -v | grep -i "dirty" && echo "Possibly vulnerable"
# Better: use your package manager
grep CONFIG_CMDLINE /boot/config-$(uname -r)

Automation script to apply the fix

Save this as fix-kernel-overwrite.sh and run as root. Works on Ubuntu, Rocky, SUSE.

bash

#!/bin/bash
# Kernel overwrite vulnerability fix (Dirty Pipe style)
# Run as root

set -e
DISTRO=$(grep ^ID= /etc/os-release | cut -d= -f2 | tr -d '"')

echo "[+] Checking and fixing kernel overwrite bug..."

case $DISTRO in
  ubuntu)
    apt update
    apt install -y linux-image-generic
    ;;
  rocky|rhel|centos)
    yum update -y kernel
    ;;
  suse|opensuse-leap)
    zypper refresh
    zypper update -y kernel-default
    ;;
  *)
    echo "Distro not recognized. Update kernel manually."
    exit 1
    ;;
esac

echo "[+] Kernel updated. You MUST reboot."
echo "[+] After reboot, verify with: uname -r"

Make it executable: chmod +x fix-kernel-overwrite.sh && sudo ./fix-kernel-overwrite.sh

Alternative mitigation if you can't update now

No reboot? No problem. Use these live mitigations.

1. iptables (block local exploit attempts from untrusted users)

bash

# Block kernel write attempts from web users (Apache/Nginx)
sudo iptables -A OUTPUT -m owner --uid-owner www-data -j DROP
# Block all non-root users from writing to /etc (aggressive)
sudo iptables -A OUTPUT -m owner --uid-owner 1000-60000 -j REJECT

2. AppArmor (enforce file write restrictions)

Create /etc/apparmor.d/usr.sbin.critical-protect:

text

/usr/sbin/critical-protect {
  deny /etc/shadow w,
  deny /etc/passwd w,
  deny /boot/vmlinuz* w,
  deny /etc/ssl/private/* rw,
}

Load it: sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.critical-protect

3. Seccomp (for containers)

Block splice() and write() syscalls for untrusted containers:

bash

docker run --security-opt seccomp=block-splice.json your-app

Suggested reading

Mastering Linux Security and Hardening (3rd Edition)  – by Donald A. Tevault Amazon 

Why this book: 

This is the practical, distro-agnostic guide that actually matches our evergreen content. It covers kernel hardening (sysctl tuning, module blacklisting), user privilege lockdown, firewalls, and intrusion detection. The third edition uses Ubuntu and AlmaLinux, so it works for both Debian and RHEL families.

Direct fit for our content: Chapter on "Harden the Linux kernel configuration" gives you the why behind the patch commands we provided. The book also includes OpenSCAP automation—perfect for the "automation script" section.

Learning Kubernetes Security (2nd Edition) – by Raul Lapaz - Amazon

Why this book: 

Practical, hands-on Kubernetes security with labs on Falco, Cilium, and Tetragon. Covers container escapes, pod security standards, and runtime threat detection.

Direct fit: For readers running Kubernetes in production, this book answers: "How do I detect a Dirty Pipe-style attack across 50 nodes?"

Affiliate disclosure: As an Amazon Associate, I earn from qualifying purchases. This helps me keep writing in-depth security guides – at no extra cost to you.)

Here's the hard truth: By the time you hear about the next Dirty Pipe, you're already late.

The sysadmins who sleep well at night aren't the ones who chase CVEs on Twitter. They're the ones who built a system:

✅ A one-line check for any kernel write bug

✅ A script that patches Ubuntu, Rocky, and SUSE without thinking

✅ A fallback plan (iptables/AppArmor) for the "can't reboot" days

You now have all four.

But knowing isn't the same as doing.

I send one real kernel exploit analysis + a working patch script every Friday. No theory. No marketing fluff. Just commands you can copy-paste into your production servers.