A highly serious Linux kernel vulnerability known as “Dirty Pipe” affects the Google Pixel 6, Samsung Galaxy S22, and several other new Android 12 devices. A malicious software can use this flaw to get system-level access and overwrite data in read-only files on the system. The problem was first discovered in the Linux kernel and was later replicated on Pixel 6 by a security researcher. Google was also made aware of its presence in order to roll out a patched system upgrade.
The ‘Dirty Pipe’ vulnerability was discovered by security researcher Max Kellermann of the German Web development company CM4all. Other researchers were able to outline the impact of the security flaw, which has been labelled CVE-2022-0847, shortly after Kellermann officially exposed it this week.
According to Kellermann, the problem has been present in the Linux kernel from version 5.8, however it was addressed in Linux 5.16.11, 5.15.25, and 5.10.102. It’s comparable to the ‘Dirty COW’ vulnerability, but the researcher claims it’s easier to exploit.
The vulnerability known as ‘Dirty COW’ affected Linux kernel versions prior to 2018. It also affected Android users, though Google addressed the flaw in December 2016 with a security patch.
An attacker who takes advantage of the ‘Dirty Pipe’ vulnerability on the Linux system can erase data in read-only files. By getting backdoor access, hackers may be able to create unauthorised user accounts, modify scripts, and binaries.
Because Android is based on the Linux kernel, the flaw has the potential to affect smartphone users as well. It is, however, currently limited in scope, due to the fact that most Android releases do not use the Linux kernel versions impacted by the bug.
“Android prior to version 12 is not affected at all,” Kellermann told Gadgets 360. “Android 12 devices — but not all — are affected.”
If the device was vulnerable, the researcher added, the issue might be used to get full root access. This implies a software may read and manipulate encrypted WhatsApp communications, capture validation SMS messages, impersonate users on arbitrary websites, and even remotely control any banking apps installed on the smartphone to steal money.
Kellermann was able to duplicate the flaw on the Google Pixel 6 and informed the Android security team about it in February. Shortly after receiving the researcher’s report, Google incorporated the issue patch into the Android kernel.
It’s unclear whether the flaw was resolved in the March security patch, which was released earlier this week.
According to Ron Amadeo of Ars Technica, the flaw affects the Samsung Galaxy S22 devices in addition to the Pixel 6.
Due to the ‘Dirty Pipe’ issue, several other devices running Android 12 out-of-the-box are expected to be vulnerable to assaults.
Tech Media has contacted Google and Samsung for comment on the issue, and will update readers as soon as they respond.
Users are advised not to install programmes from any third-party sources in the meanwhile. It’s also crucial to avoid installing any untrustworthy apps or games, and to make sure your device is up to date with security fixes.