Log in Start free

Actively exploited · Published Jul 17, 2019 · Assigned by mitre

CVE-2019-13272

High 7.8 Exploited

In plain English

A high-severity security flaw in Kernel from Linux. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 52.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)52.2%top 1.0% of all CVEs
Exploited in the wildYesCISA KEV since Dec 10, 2021
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 10, 2022.

Official description

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux4.19.37-6DEBIAN-CVE-2019-13272
Debian:13linux4.19.37-6DEBIAN-CVE-2019-13272
Debian:14linux4.19.37-6DEBIAN-CVE-2019-13272
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2019-13272
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2019-13272
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2019-13272
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2019-13272

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References