The "dirty pipe" vulnerability

Max Kellermann has disclosed a disconcerting kernel vulnerability:

Two weeks ago, I found a vulnerability in the Linux kernel sinceversion 5.8 commit f6dd975583bd ("pipe: merge anon_pipe_buf*_ops") dueto uninitialized variables. It enables anybody to write arbitrarydata to arbitrary files, even if the file is O_RDONLY, immutable or ona MS_RDONLY filesystem. It can be used to inject code into arbitraryprocesses.

This vulnerability has been named "dirty pipe"; Kellermann has put up a web page describing it indetail. Updates from distributors are already being released.