How Does Dirty Cred Vulnerability Work? And How to Protect Your Linux Kernel From Dirty Cred Vulnerability?

A group of academics from Northwestern University has disclosed a new privilege escalation vulnerability dubbed “Dirty Cred” in the Linux Kernel. Researchers say that though the new exploitation is similar in impact as same as the 6-month-old privilege escalation vulnerability “Dirty Pipe,” however it is more universal in nature. We are here to let you know more about the Dirty Cred vulnerability, like how does it work and how you should protect your Linux Kernel from the vulnerability. Since it is more generic than any other Kernel permission bypass vulnerability, it is much required to know how does Dirty Cred vulnerability work and how you should protect your Linux Kernel from Dirty Cred vulnerability.

Dirty Pipe vs Dirty Cred

If you remember “Dirty Pipe” (CVE-2022-0847), one of the serious privilege escalation vulnerabilities that made news headlines early in the year, which abuses the Linux kernel pipe mechanism to inject data to arbitrary files. Dirty Cred also has the capability to create the same impact as Dirty Pipe. Although Dirty Cred has the same impact, it is more generic and powerful than Dirty Pipe vulnerability. This is because, Dirty Pipe, as a vulnerability, doesn’t deal with kernel address randomization and pointer integrity check; moreover, a pipe-abusive power is required to exploit the Dirty Pipe vulnerability, which is harder to follow.

Image Source:

Well, in the case of Dirty Cred, it works with any vulnerabilities with double-free ability to demonstrate dirty-pipe-like ability. Additionally, it inherits all the kernel protections bypass capabilities and takes the Dirty Pipe like vulnerability to the next level that allows the ability to overwrite an arbitrary file to escalate privilege. Researchers also noted that Dirty Cred vulnerability is capable of escaping the container actively that dirty pipe is not capable of.

Despite all these, what makes Dirty Cred different then Dirty Pipe is that Dirty Pipe abuses the Linux Kernel mechanism to inject data into unprivileged arbitrary files. The same Dirty Cred also abuses the Linux Kernel credential permission mechanism to write data to unprivileged arbitrary files and run high privileged commands in root contests.

Summary of Dirty Cred Vulnerability – CVE-2022-2588

Dirty Cred is a local privilege escalation vulnerability that is capable of bypassing kernel credential permission checks such as Control Flow Integrity (CFI). The vulnerability has been tracked under the CVE ID CVE-2022-2588, with a CVSS score of 6.7 that enables attackers to perform privilege escalation by bypassing kernel credential permission checks.

The flaw lice in improper implementation of route4_change in the net/sched/cls_route.c filter in the Linux Kernel. The problem is due to the non-removal of an old filter from the hashtable before freeing it in some conditions. The flaw allows a local attacker to perform privilege escalation attacks and achieve further attacks like a denial of service, system crash, arbitrary code execution, and arbitrary command execution.

This image is captured by the author

Important Points to Be Noted About the Dirty Cred Vulnerability:

This image is captured by the author

Kernel Version Affected by the Dirty Cred Vulnerability – Cve-2022-2588

Since the flaw affects all versions of the Linux Kernel, it affects pretty much everything that is built on the Linux Kernel. At the time of publishing this article, no patches were rolled out by Kernel moderators since we are still in the early stage of the bug. We recommend doing a regular check-in kernel.org to see the latest updates on the release of the new Kernel version.

For more information about the affected Kernel versions, please visit your Linux distributions.

How Does Dirty Cred Vulnerability Work?

To understand the Dirty Cred vulnerability, it is required to know about the Kernel Credential and User Permission System in Linux. Theoretically, Linux has 7 types of objects: Tasks, Files/inodes, Sockets, Message queues, Shared memory segments, Semaphores, and Keys. All these objects are associated with a set of credentials to define the ownership and access permission of these objects. The Dirty Cred vulnerability has been described using Task and File credentials.