Security researcher Max Kellermann has identified and disclosed to the Linux kernel security team, a critical Linux vulnerability named “Dirty Pipe”, which if exploited, could allow local users with read permissions to acquire root privileges by leveraging multiple publicly available exploits. The vulnerability, tracked as CVE-2022-0847, allows a non-privileged user to inject and overwrite arbitrary data within files and Set owner User ID up on execution (SUID) processes. This could allow attackers to escalate their privileges, and change configurations of the exploited files, giving them complete control. Kellerman included a proof-of-concept (PoC) exploit in his disclosure of Dirty Pipe, and even simpler exploitation methods were shared by other researchers known on Twitter as “Phithon”, and “BLASTY”. This vulnerability affects all Linux distributions from version eight and up, however it has been patched in versions 5.16.11, 5.15.25 and 5.10.102. Kellerman has stated that Dirty Pipe is very similar to another Linux vulnerability from 2016 known as “Dirty COW” (CVE-2016-5195). Dirty COW was eventually used as an attack vector leveraged by state sponsored threat actors to conduct malware attacks, and it is likely inevitable that threat actors today begin exploiting the vulnerability. Although it has been successfully patched, this exploit still poses an extreme risk due to many servers still running outdated versions of the Linux kernel, and especially poses a risk to organizations who offer Linux shell assess, like web hosting providers and universities. The Ankura CTIX urges all administrators to immediately update to the latest patch, and future Linux vulnerabilities will continue to be reported on in the future.