CVE-2019-13272
Linux Kernel Improper Privilege Management Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 10 June 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 52.20% probability · 99th percentile
- CISA KEV
- Listed 10 December 2021 · due 10 June 2022
- Affected
- linux/linux kernel · debian/debian linux · fedoraproject/fedora · canonical/ubuntu linux · redhat/enterprise linux · redhat/enterprise linux for arm 64 · redhat/enterprise linux for ibm z systems · redhat/enterprise linux for real time · redhat/enterprise linux for real time for nfv · redhat/enterprise linux for real time for nfv tus · redhat/enterprise linux for real time tus · netapp/aff a700s firmware · netapp/h410c firmware · netapp/h610s firmware · netapp/active iq unified manager · netapp/e-series performance analyzer · netapp/e-series santricity os controller · netapp/hci management node · netapp/service processor · netapp/solidfire · +2 more
- Source
- cve@mitre.org
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-13272
References
- http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2405Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2411Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2809Third Party Advisory
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1903Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1730895Issue Tracking, Patch
- https://bugzilla.suse.com/show_bug.cgi?id=1140671Issue Tracking, Patch, Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17Patch, Vendor Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41eePatch, Vendor Advisory
- https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41eePatch
- https://lists.debian.org/debian-lts-announce/2019/07/msg00022.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/07/msg00023.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK5LYWBJ4E4SRI4DKX367NHYSI3VOH/Release Notes
- https://seclists.org/bugtraq/2019/Jul/30Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Jul/33Issue Tracking, Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190806-0001/Third Party Advisory
- https://support.f5.com/csp/article/K91025336Third Party Advisory
- https://support.f5.com/csp/article/K91025336?utm_source=f5support&%3Butm_medium=RSSThird Party Advisory
- https://usn.ubuntu.com/4093-1/Third Party Advisory
- https://usn.ubuntu.com/4094-1/Third Party Advisory
- https://usn.ubuntu.com/4095-1/Third Party Advisory
- https://usn.ubuntu.com/4117-1/Third Party Advisory
- https://usn.ubuntu.com/4118-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4484Third Party Advisory
- http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.htmlThird Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.