Beware of the Dirty Pipe Exploit on Android
The Dirty Pipe vulnerability, also called the CVE-2022-0847 (a number assigned to common vulnerabilities), was discovered by Android developer Max Kellerman. He used a Pixel 6 to discover the vulnerability and reported it to Google. The vulnerability originated with Linux 5.8, which was released for Android back in 2020. According to Ars Technica’s Ron Amadeo, the vulnerability affects only brand new Android 12 devices like the Pixel 6 and Galaxy S22 devices. By my count, Dirty Pipe affects only brand-new Android 12 devices like the Pixel 6 and S22. Linux 5.8 and above has only been an Android option for five months. https://t.co/WmstZDoA5t pic.twitter.com/PEFhcwUQYV— Ron Amadeo (@RonAmadeo) March 8, 2022
So, while your Galaxy S22 Ultra may be physically strong, the device can easily get infected by a vulnerability. It has been termed as one of the most high-severity vulnerabilities and affects Linux-powered devices like Android-based smartphones, Google Home devices, Chromebooks, and more.
How Does the Vulnerability Work?
It is suggested that the Dirty Pipe affects Linux pipes (to transfer data from an app or process to another) and Pages (the small chunks of memory). This bug can exploit the pipes and pages, thus, allowing attackers to change the data or have full control over the device. You can read all the technical details over here.
Following Kellerman’s reporting, Linux released fixes for supported devices in the form of 5.16.11, 5.15.25, 5.10.102 last month. After that, Google also integrated Kellerman’s fix in the Android kernel. Although it has not yet been released for users as of writing this story. It is suggested that Google will release the fix for Dirty Pipe either with a special patch update or with the April security update.
If you are worried that your Galaxy S22 device or Pixel 6 device is at risk, you can go to Settings and check your Kernel version. If it is higher than 5.8, then your phone is potentially exposed to the Dirty Pipe vulnerability. Fortunately, the exploit has not yet been used by an attacker in the wild. However, the researchers have theorized proof of concept examples to show how Dirty Pipe can be used to easily infiltrate a vulnerable device.
So, if you are using a Pixel 6 device or a Galaxy S22 model with a Kernel version higher than 5.8, beware of untrusted apps asking for system permissions on your device until Google releases the fix. Also, stay tuned for further updates on this issue in the coming days.
