CVE-2019-13272
Linux Kernel Improper Privilege Management Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 10 June 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 52.20% probability · 99th percentile
- Public exploits
- 4 in Exploit-DB · verified · first 17 July 2019
- CISA KEV
- Listed 10 December 2021 · due 10 June 2022
- Affected
- linux/linux kernel · debian/debian linux · fedoraproject/fedora · canonical/ubuntu linux · redhat/enterprise linux · redhat/enterprise linux for arm 64 · redhat/enterprise linux for ibm z systems · redhat/enterprise linux for real time · redhat/enterprise linux for real time for nfv · redhat/enterprise linux for real time for nfv tus · redhat/enterprise linux for real time tus · netapp/aff a700s firmware · netapp/h410c firmware · netapp/h610s firmware · netapp/active iq unified manager · netapp/e-series performance analyzer · netapp/e-series santricity os controller · netapp/hci management node · netapp/service processor · netapp/solidfire · +2 more
- Source
- cve@mitre.org
EPSS 52.2% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-13272
Public exploits (4)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-50541source ↗ | Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)linux · Ujas Dhami | local | 23 November 2021 | no |
| EDB-47543source ↗ | Linux Polkit - pkexec helper PTRACE_TRACEME local root (Metasploit)linux · Metasploit | local | 24 October 2019 | yes |
| EDB-47163source ↗ | Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalationlinux · bcoles | local | 24 July 2019 | no |
| EDB-47133source ↗ | Linux - Broken Permission and Object Lifetime Handling for PTRACE_TRACEMElinux · Google Security Research | local | 17 July 2019 | yes |
References
- http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2405Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2411Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2809Third Party Advisory
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1903Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1730895Issue Tracking, Patch
- https://bugzilla.suse.com/show_bug.cgi?id=1140671Issue Tracking, Patch, Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17Patch, Vendor Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41eePatch, Vendor Advisory
- https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41eePatch
- https://lists.debian.org/debian-lts-announce/2019/07/msg00022.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/07/msg00023.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK5LYWBJ4E4SRI4DKX367NHYSI3VOH/Release Notes
- https://seclists.org/bugtraq/2019/Jul/30Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Jul/33Issue Tracking, Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190806-0001/Third Party Advisory
- https://support.f5.com/csp/article/K91025336Third Party Advisory
- https://support.f5.com/csp/article/K91025336?utm_source=f5support&%3Butm_medium=RSSThird Party Advisory
- https://usn.ubuntu.com/4093-1/Third Party Advisory
- https://usn.ubuntu.com/4094-1/Third Party Advisory
- https://usn.ubuntu.com/4095-1/Third Party Advisory
- https://usn.ubuntu.com/4117-1/Third Party Advisory
- https://usn.ubuntu.com/4118-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4484Third Party Advisory
- http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.htmlThird Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.