CVE-2019-13272

Known Exploited Public Exploit

Description

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

7.8

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 83.58% Top 5%

KEV Since

Vendor Advisory fedoraproject.org Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory kernel.org Vendor Advisory kernel.org

Affected: n/a n/a

References

Link	Tags
http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.html	third party advisory vdb entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1903	patch exploit third party advisory issue tracking
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17	patch vendor advisory
https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee	patch
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41ee	patch vendor advisory
https://bugzilla.suse.com/show_bug.cgi?id=1140671	patch third party advisory issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1730895	patch issue tracking
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK5LYWBJ4E4SRI4DKX367NHYSI3VOH/	release notes vendor advisory
https://www.debian.org/security/2019/dsa-4484	third party advisory vendor advisory
https://seclists.org/bugtraq/2019/Jul/30	mailing list third party advisory issue tracking
https://seclists.org/bugtraq/2019/Jul/33	mailing list third party advisory issue tracking
https://lists.debian.org/debian-lts-announce/2019/07/msg00022.html	third party advisory mailing list
https://lists.debian.org/debian-lts-announce/2019/07/msg00023.html	third party advisory mailing list
http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html	third party advisory vdb entry
https://security.netapp.com/advisory/ntap-20190806-0001/	third party advisory
https://access.redhat.com/errata/RHSA-2019:2405	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:2411	third party advisory vendor advisory
https://usn.ubuntu.com/4093-1/	third party advisory vendor advisory
https://usn.ubuntu.com/4094-1/	third party advisory vendor advisory
https://usn.ubuntu.com/4095-1/	third party advisory vendor advisory
http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html	third party advisory vdb entry exploit
https://support.f5.com/csp/article/K91025336	third party advisory
https://usn.ubuntu.com/4117-1/	third party advisory vendor advisory
https://usn.ubuntu.com/4118-1/	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2019:2809	third party advisory vendor advisory
https://support.f5.com/csp/article/K91025336?utm_source=f5support&%3Butm_medium=RSS	third party advisory
http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.html	third party advisory vdb entry exploit
http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html	third party advisory vdb entry exploit
http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.html	third party advisory vdb entry exploit

Frequently Asked Questions

What is the severity of CVE-2019-13272?: CVE-2019-13272 has been scored as a high severity vulnerability.
How to fix CVE-2019-13272?: To fix CVE-2019-13272, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-13272 being actively exploited in the wild?: It is confirmed that CVE-2019-13272 is actively exploited. Be extra cautious if you are using vulnerable components. According to its EPSS score, there is a ~84% probability that this vulnerability will be exploited by malicious actors in the next 30 days.