Taiwanese hardware vendor QNAP warns most of its Network Attached Storage (NAS) devices are impacted by a high severity Linux vulnerability dubbed 'Dirty Pipe' that allows attackers with local access to gain root privileges.

The 'Dirty Pipe' security bug affects Linux Kernel 5.8 and later versions, even on Android devices. If successfully exploited, it allows non-privileged users to inject and overwrite data in read-only files, including SUID processes that run as root. 

While a patch was released for the security flaw one week ago with Linux kernels versions 5.16.11, 5.15.25, and 5.10.102, QNAP says that its customers will have to wait until the company releases its own security updates.

Impacts NAS devices running kernel version 5.10.60
The company says that the bug impacts devices running QTS 5.0.x and QuTS hero h5.0.x, including:

• QTS 5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS
• QuTS hero h5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS

You can find a complete list of all affected models on this kernel list page under the "Kernel Version 5.10.60" entry. QNAP added that none of its NAS devices running QTS 4.x are affected and vulnerable to attacks.

Until QNAP releases security updates to address the Dirty Pipe vulnerability, you should ensure that your NAS device is not exposed to Internet attacks to block attempts to gain local access.

Customers who have Internet-exposed NAS devices should take the following measures to defend from attacks:

• Disable the Port Forwarding function of the router: Go to the management interface of your router, check the Virtual Server, NAT, or Port Forwarding settings, and disable the port forwarding setting of NAS management service port (port 8080 and 433 by default).
• Disable the UPnP function of the QNAP NAS: Go to myQNAPcloud on the QTS menu, click the "Auto Router Configuration," and unselect "Enable UPnP Port forwarding."

QNAP also provides detailed steps on how to toggle off SSH and Telnet connections and change the system port number, change device passwords and enable IP and account access protection.

The information contained in this website is for general information purposes only. The information is gathered from BleepingComputer, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.