Technical Review: A Deep Analysis of the Dirty Pipe Vulnerability

This report analyzes the Dirty Pipe (CVE-2022-0847) Linux kernel vulnerability: it explains how zero-copy splice and uninitialized pipe buffer flags let an attacker copy a page reference into a pipe and then write to that page-cache entry to modify read-only files from an unprivileged context. The paper details the kernel internals that lead to the flaw, demonstrates an exploit workflow and its limitations (one-page-per-use, cannot change file size or first-byte), shows how in-kernel/eBPF monitoring (Tracee) can detect the splice-to-unprotected-pipe behavior, and recommends patching to fixed kernel versions (5.10.102, 5.15.25, 5.16.11) and using runtime protection.