Skip to content
Fencer Intel
high 7.8

CVE-2019-13272 kev in the critical feed json

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to cr…

published 7y ago modified 4mo ago also EUVD-2019-4779

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2021-12-10
epss
52.2%
EPSS 52.2% chance of exploitation in 30 days, percentile 98%
public exploits
5
Metasploit and Exploit-DB

Summary

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • linux linux_kernel 3.16.71, 4.2, 4.4.185, 4.9, 4.9.185, 4.14.133, 4.19.58, 5.1.17
  • linux Debian 14, Debian 13, Debian 12 4.19.37-6

debian advisories DEBIAN-CVE-2019-13272

  • linux Ubuntu 16.04 LTS 4.4.0-159.187
  • linux Ubuntu 18.04 LTS 4.15.0-58.64
  • linux-aws Ubuntu 16.04 LTS 4.4.0-1090.101
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1047.49
  • linux-gcp Ubuntu 16.04 LTS 4.15.0-1040.42~16.04.1
  • linux-gcp Ubuntu 18.04 LTS 4.15.0-1040.42
  • linux-hwe Ubuntu 16.04 LTS 4.15.0-58.64~16.04.1
  • linux-hwe Ubuntu 18.04 LTS 5.0.0-25.26~18.04.1

ubuntu advisories UBUNTU-CVE-2019-13272

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-alt RHEL 7 4.14.0-115.12.1.el7a
  • perf RHEL 7 4.14.0-115.12.1.el7a
  • kernel RHEL 7 4.14.0-115.12.1.el7a
  • python-perf RHEL 7 4.14.0-115.12.1.el7a
  • kernel-tools RHEL 7 4.14.0-115.12.1.el7a
  • kernel-tools-libs RHEL 7 4.14.0-115.12.1.el7a
  • kernel-bootwrapper RHEL 7 4.14.0-115.12.1.el7a
  • kernel-abi-whitelists RHEL 7 4.14.0-115.12.1.el7a

red hat advisories RHSA-2019:2809RHSA-2019:2405RHSA-2019:2411

  • kernel-syms SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 4.4.121-92.125.1
  • kernel-source SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 4.4.121-92.125.1
  • kernel-default SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 4.4.121-92.125.1
  • kgraft-patch-SLE12-SP2_Update_33 SLES for SAP 12 SP2, SLES 12 SP2-LTSS, OpenStack Cloud 7 1-3.5.1
  • kernel-syms SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.4.180-94.107.1
  • kernel-source SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.4.180-94.107.1
  • kernel-default SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +5 more 4.4.180-94.107.1
  • kgraft-patch-SLE12-SP3_Update_29 SLES for SAP 12 SP3, SLES 12 SP3-LTSS, OpenStack Cloud Crowbar 8 +3 more 1-4.3.1

suse advisories SUSE-SU-2019:3263-1SUSE-SU-2019:3261-1SUSE-SU-2019:3260-1SUSE-SU-2019:3258-1SUSE-SU-2019:3252-1SUSE-SU-2019:3249-1

Is CVE-2019-13272 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-13272 updated cvss 7.8

kernel: broken permission and object lifetime handling for PTRACE_TRACEME

  • Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-80.7.2.el8_0, kernel-debuginfo-common-aarch64 4.18.0-80.7.2.el8_0, kernel-debuginfo-common-ppc64le 4.18.0-80.7.2.el8_0 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-80.7.2.el8_0, kernel 4.18.0-80.7.2.el8_0, bpftool 4.18.0-80.7.2.el8_0, kernel-core 4.18.0-80.7.2.el8_0, kernel-tools 4.18.0-80.7.2.el8_0, python3-perf 4.18.0-80.7.2.el8_0, +15 more
    fixed: vendor fix “For mitigation, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4292201” RHSA-2019:2411
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) perf 4.14.0-115.12.1.el7a, kernel 4.14.0-115.12.1.el7a, kernel-alt 4.14.0-115.12.1.el7a, python-perf 4.14.0-115.12.1.el7a, kernel-tools 4.14.0-115.12.1.el7a, kernel-tools-libs 4.14.0-115.12.1.el7a, +3 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) kernel-debuginfo-common-ppc64le 4.14.0-115.12.1.el7a
    fixed: vendor fix “For mitigation, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4292201” RHSA-2019:2809
  • Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-core 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-modules 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-core 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-modules 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-modules-extra 4.18.0-80.7.2.rt9.154.el8_0, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-kvm 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-core 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-modules 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-kvm 4.18.0-80.7.2.rt9.154.el8_0, kernel-rt-debug-core 4.18.0-80.7.2.rt9.154.el8_0, +4 more
    fixed: vendor fix “For mitigation, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4292201” RHSA-2019:2405
  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware Red Hat Virtualization 4 redhat-virtualization-host-image-update
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/local/ptrace_traceme_pkexec_helper)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4y ago
Patch by
2022-06-10 (4y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Linux, Kernel
CISA name
Linux Kernel Improper Privilege Management Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

52.20% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/linux/local/ptrace_traceme_pkexec_helper Linux Polkit pkexec helper PTRACE_TRACEME local root exploit metasploit exploit, excellent rank, 2019-07-04
  • EDB-50541 Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2) local, 2021-11-23
  • EDB-47543 Linux Polkit - pkexec helper PTRACE_TRACEME local root (Metasploit) local, 2019-10-24
  • EDB-47163 Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation local, 2019-07-24
  • EDB-47133 Linux - Broken Permission and Object Lifetime Handling for PTRACE_TRACEME local, 2019-07-17
  • bugs.chromium.org https://bugs.chromium.org/p/project-zero/issues/detail?id=1903 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.