{"id":621,"date":"2026-09-14T21:14:35","date_gmt":"2026-09-14T13:14:35","guid":{"rendered":"http:\/\/pareto.fun\/?p=621"},"modified":"2026-09-14T21:14:35","modified_gmt":"2026-09-14T13:14:35","slug":"dirty-pipe-cve-2022-0847","status":"publish","type":"post","link":"http:\/\/pareto.fun\/?p=621","title":{"rendered":"dirty pipe CVE-2022-0847"},"content":{"rendered":"\n

Dirty Pipe \u7684\u6839\u56e0\u662f\uff0c\u73af\u5f62 slot \u88ab\u590d\u7528\u65f6\uff0c\u6587\u4ef6\u9875\u5bf9\u5e94\u7684\u65b0 pipe_buffer<\/code> \u6ca1\u6709\u521d\u59cb\u5316 flags<\/code>\uff0c\u9519\u8bef\u7ee7\u627f\u4e86\u65e7\u7684 PIPE_BUF_FLAG_CAN_MERGE<\/code>\uff0c\u5bfc\u81f4\u540e\u7eed write(pipe)<\/code> \u628a\u6570\u636e\u76f4\u63a5\u5408\u5e76\u8fdb\u53ea\u8bfb\u6587\u4ef6\u7684 page cache \u9875\u3002<\/p>\n\n\n\n

\u5b8c\u6574\u89e6\u53d1\u8fc7\u7a0b<\/h2>\n\n\n\n

1. \u5148\u7528\u666e\u901a write \u586b\u5145 pipe<\/h3>\n\n\n\n

\u666e\u901a anon_pipe_write()<\/code> \u521b\u5efa\u7684 buffer \u4f1a\u8bbe\u7f6e\uff1a<\/p>\n\n\n\n

buf->flags = PIPE_BUF_FLAG_CAN_MERGE;<\/pre>\n\n\n\n
\u5047\u8bbe\u67d0\u4e2a slot\uff1a<\/p>\n\n\n\n
slot N:
page  = \u533f\u540dpipe\u9875
flags = CAN_MERGE
ops   = anon_pipe_buf_ops<\/pre>\n\n\n\n
2. \u628a pipe \u8bfb\u7a7a<\/h3>\n\n\n\n
\u8bfb\u7aef\u6d88\u8d39\u5b8c\u540e\uff1a<\/p>\n\n\n\n
pipe_buf_release(pipe, buf);
pipe->tail++;<\/pre>\n\n\n\n
\u4f46 pipe_buf_release()<\/code> \u53ea\u6e05\u9664\uff1a<\/p>\n\n\n\n
buf->ops = NULL;<\/pre>\n\n\n\n
\u4e0d\u4f1a\u6e05\u7406\uff1a<\/p>\n\n\n\n
buf->flags
buf->page
buf->offset
buf->len<\/pre>\n\n\n\n
\u6240\u4ee5\u7a7a\u95f2 slot \u4e2d\u53ef\u80fd\u6b8b\u7559\uff1a<\/p>\n\n\n\n
slot N:
ops   = NULL
flags = CAN_MERGE    \u2190 \u6b8b\u7559<\/pre>\n\n\n\n
\u6ce8\u610f\uff1a\u6b8b\u7559\u672c\u8eab\u8fd8\u4e0d\u662f\u6f0f\u6d1e\uff0c\u56e0\u4e3a\u8be5 slot \u903b\u8f91\u4e0a\u5df2\u7ecf\u65e0\u6548\u3002<\/p>\n\n\n\n
3. splice \u628a\u53ea\u8bfb\u6587\u4ef6\u9875\u653e\u5165\u8fd9\u4e2a slot<\/h3>\n\n\n\n
\u653b\u51fb\u8005\u5bf9\u53ea\u8bfb\u6587\u4ef6\u6267\u884c\u7c7b\u4f3c\uff1a<\/p>\n\n\n\n
splice(file_fd, &offset, pipe_write_fd, NULL, 1, 0);<\/pre>\n\n\n\n
splice()<\/code> \u4e0d\u590d\u5236\u6587\u4ef6\u5185\u5bb9\uff0c\u800c\u662f\u8ba9 pipe_buffer.page<\/code> \u76f4\u63a5\u5f15\u7528\u6587\u4ef6\u7684 page cache \u9875\u3002<\/p>\n\n\n\n
\u6f0f\u6d1e\u7248\u672c\u521d\u59cb\u5316\u4e86\uff1a<\/p>\n\n\n\n
buf->page   = file_page;
buf->offset = offset;
buf->len    = len;
buf->ops    = &page_cache_pipe_buf_ops;<\/pre>\n\n\n\n
\u4f46\u662f\u6f0f\u6389\u4e86\uff1a<\/p>\n\n\n\n
buf->flags = 0;<\/pre>\n\n\n\n
\u7ed3\u679c\u53d8\u6210\uff1a<\/p>\n\n\n\n
slot N:
page  = \u53ea\u8bfb\u6587\u4ef6\u7684page cache\u9875
ops   = page_cache_pipe_buf_ops
flags = CAN_MERGE                  \u2190 \u9519\u8bef\u7ee7\u627f<\/pre>\n\n\n\n
splice \u5b8c\u6210\u540e\u8fd8\u4f1a\u63a8\u8fdb\uff1a<\/p>\n\n\n\n
pipe->head++;<\/pre>\n\n\n\n
\u6240\u4ee5\u8fd9\u4e2a\u6587\u4ef6\u9875 buffer \u73b0\u5728\u6b63\u597d\u662f\uff1a<\/p>\n\n\n\n
pipe_buf(pipe, head - 1)<\/pre>\n\n\n\n
\u4e5f\u5c31\u662f\u4e0b\u4e00\u6b21 pipe \u5199\u5165\u68c0\u67e5\u7684\u201c\u6700\u540e\u4e00\u4e2a\u6709\u6548 buffer\u201d\u3002<\/p>\n\n\n\n
4. \u518d\u6b21 write(pipe)<\/h3>\n\n\n\n
anon_pipe_write()<\/code> \u6267\u884c\uff1a<\/p>\n\n\n\n
buf = pipe_buf(pipe, head - 1);
\u200b
if ((buf->flags & PIPE_BUF_FLAG_CAN_MERGE) &&
    offset + chars <= PAGE_SIZE) {
    copy_page_from_iter(buf->page, offset, chars, from);
}<\/pre>\n\n\n\n
\u56e0\u4e3a\u6587\u4ef6\u9875\u9519\u8bef\u5e26\u6709\uff1a<\/p>\n\n\n\n
PIPE_BUF_FLAG_CAN_MERGE<\/pre>\n\n\n\n
\u68c0\u67e5\u901a\u8fc7\uff0c\u4e8e\u662f\uff1a<\/p>\n\n\n\n
copy_page_from_iter()<\/pre>\n\n\n\n
\u76f4\u63a5\u628a\u653b\u51fb\u8005\u6570\u636e\u5199\u5165\uff1a<\/p>\n\n\n\n
\u53ea\u8bfb\u6587\u4ef6\u7684 page cache \u9875<\/pre>\n\n\n\n
\u8fd9\u4e00\u8fc7\u7a0b\u6ca1\u6709\u8d70\u6b63\u5e38\u7684\u6587\u4ef6\u5199\u5165\u8def\u5f84\uff0c\u56e0\u6b64\u7ed5\u8fc7\u4e86\uff1a<\/p>\n\n\n\n