Maximize your protection, eliminate business risks.
Optimize and modernize with cloud transformation.
Empower your people to work securely from anywhere.
What it takes to convince leadership that migrating to the cloud is the right move.
Let us handle IT so you can focus on growing your business.
Get multichannel 24/7/365 expert end-user support.
Stay ahead of attacks with 24/7 protection and monitoring.
Maximize uptime with with industry-leading DRaaS.
Improve efficiency, productivity and outcomes with cloud.
Ensure all mobile devices, everywhere, are secure.
Gain a competitive edge with strategic IT solutions.
This battle-tested checklist enables your team to swiftly initiate a ransomware response.
IT for businesses of all sizes, in any industry.
Empower institution growth with custom IT solutions.
Ensure your firm is always in compliance.
Improve patient care and staff morale.
Deal with pressing legal matters, not IT.
Keep up with the evolving digital landscape.
Focus on your mission by outsourcing IT.
Accelerate PE client deals and secure data.
Leverage your technology as a strategic asset.
Execute initiatives and develop IT strategies.
Get the latest industry insights and trends.
Join us at events in person and online.
Hear from clients and learn more about strategic IT.
See how Dataprise can make IT your greatest asset.
Get informative technical resources from IT experts.
Stay on stop of emerging cybersecurity threats.
Discover the key areas of DR your organization needs to address to ensure downtime is minimized.
Gain a strategic asset by bringing harmony to IT.
Ensure 24/7 support and security with dedicated teams.
Drive business forward by partnering with Dataprise.
Meet our one-of-a-kind leadership team.
Discover the recognition Dataprise has earned.
Help us help businesses with strategic IT.
Embracing different perspectives and backgrounds.
Find a Dataprise location near you.
Dataprise is committed to empowering more women to consider a career in technology.
Defense Digests
Table of content
On March 8th, 2022 researchers discovered a vulnerability that allows for overwriting arbitrary read-only values, including /etc/shadow, allowing unprivileged actors to overwrite values and execute privileged processes as root. This vulnerability is considered high severity and affects all Linux kernel versions since 5.8. This vulnerability requires a user to have access to at least a low-level authorized user account to escalate privileges, therefore this vulnerability is assessed to be a High priority for patches and a Medium priority for exploitation as Proof of Concept code is available.
Severity: 8 (High)
Privilege Escalation; Low privilege authenticated users can run processes or inject data as root
Pipe buffer flags allow merging commands which can allow instructions in the 4kb memory page buffer to overflow and write to additional processes or files as root. The practical application of this vulnerability is to overwrite the /etc/shadow file, or to tie in a process execution allowing for the process to be run with root privileges for any file or process currently in the page cache.
This vulnerability is in Linux kernels 5.8 and higher due to an uninitialized “pipe_buffer.flags” variable.
**NOTE: The file write or process executed cannot be run outside of the page boundary, i.e. no execution or writes across multiple pages of memory. All execution is limited to the 4kb block targeted.
Any system using Linux kernels 5.16.11, 5.15.25, and 5.10.102, or below are vulnerable. Unfortunately, server admins continue to run outdated kernels and this can be significantly disruptive to update.
This is especially troubling for web hosting providers offering shell access.
Update to Linux kernels 5.16.11, 5.15.25, and 5.10.102.
https://www.bleepingcomputer.com/news/security/new-linux-bug-gives-root-on-all-major-distros-exploit-released https://www.zdnet.com/article/how-many-linux-users-are-there-anyway/ https://hostingtribunal.com/blog/linux-statistics/#gref https://www.top500.org/statistics/details/osfam/1/ https://ubuntu.com/security/CVE-2022-0847 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0847 https://dirtypipe.cm4all.com/ (Detailed technical release from vulnerability discovery) https://haxx.in/files/dirtypipez.c (POC code)
If you have any questions, please reach out to the Dataprise Security Operations Center at [email protected].
INSIGHTS
Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.