CVE-2019-13272highunder attack

CVE-2019-13272

Published · Updated

Follow this CVE+ Monitor Linux+ Monitor linux

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.8epss 52%
from disclosure to weaponsame day
Published on NVDJul 17
1st PoCJul 17
metasploitJul 4
CISA KEV+877d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
6 products (180 components)
Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux Real Time for NFV (v. 8) · Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) · Red Hat Enterprise Linux Real Time (v. 8) · and others 1
fix ↗
Not affected
5 products (57 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise MRG 2 · Red Hat Virtualization 4 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-06-10

Apply updates per vendor instructions.

In short

A flaw in Linux kernel's ptrace system allows a local attacker to gain root privileges by exploiting how the system records process credentials when creating a process tracing relationship. This can happen when a parent process drops privileges and runs a new program, potentially giving an attacker control.

Technical detail

CVE-2019-13272 involves a credential recording vulnerability in kernel/ptrace.c's ptrace_link function that fails to properly handle privileged ptrace relationships. The attack exploits parent-child process scenarios where privilege dropping precedes execve(), combined with object lifetime issues and incorrect privilege marking of ptrace relationships (exploitable via helpers like Polkit's pkexec with PTRACE_TRACEME), enabling local privilege escalation to root.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 41✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47543exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47133exploitdbwww.exploit-db.com/exploits/47163unverifiedexploitdbwww.exploit-db.com/exploits/50541unverifiedgithubgithub.com/jas502n/CVE-2019-13272★ 333githubgithub.com/Cyc1eC/CVE-2019-13272★ 5githubgithub.com/oneoy/CVE-2019-13272★ 4githubgithub.com/Tharana/vulnerability-exploitation★ 3githubgithub.com/josemlwdf/CVE-2019-13272★ 3githubgithub.com/MDS1GNAL/ptrace_scope-CVE-2019-13272-privilege-escalation★ 2githubgithub.com/bigbigliang-malwarebenchmark/cve-2019-13272★ 1githubgithub.com/Tharana/Exploiting-a-Linux-kernel-vulnerability★ 1githubgithub.com/Chinmay1743/ptrace-vuln★ 0githubgithub.com/letsr00t/CVE-2019-13272★ 0githubgithub.com/babyshen/CVE-2019-13272★ 0githubgithub.com/polosec/CVE-2019-13272★ 0githubgithub.com/sumedhaDharmasena/-Kernel-ptrace-c-mishandles-vulnerability-CVE-2019-13272★ 0githubgithub.com/jana30116/CVE-2019-13272-Local-Privilege-Escalation★ 0githubgithub.com/GgKendall/secureCodingDemo★ 0githubgithub.com/teddy47/CVE-2019-13272---Documentation★ 0githubgithub.com/RashmikaEkanayake/Privilege-Escalation-CVE-2019-13272-★ 0githubgithub.com/datntsec/CVE-2019-13272★ 0githubgithub.com/asepsaepdin/CVE-2019-13272★ 0vulncheckvulncheck.com/xdb/e060cd0f389funverifiedcve_referencepacketstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlunverifiedcve_referencepacketstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.htmlunverifiedvulncheckvulncheck.com/xdb/7500952732c6unverifiedvulncheckvulncheck.com/xdb/72cbc61fa5c1unverifiedvulncheckvulncheck.com/xdb/5581a09e1c77unverifiedvulncheckvulncheck.com/xdb/1df2059c8c67unverifiedvulncheckvulncheck.com/xdb/aebd1e7d7dfeunverifiedvulncheckvulncheck.com/xdb/4cdc3b31592dunverifiedvulncheckvulncheck.com/xdb/a750816d33abunverifiedvulncheckvulncheck.com/xdb/ed71c71d1008unverifiedvulncheckvulncheck.com/xdb/95bb9eeffab4unverifiedvulncheckvulncheck.com/xdb/98ec350a76a4unverifiedvulncheckvulncheck.com/xdb/94bf994e3e35unverifiedcve_referencepacketstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.htmlunverifiedcve_referencepacketstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.htmlunverifiedcve_referencepacketstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.htmlunverifiedcve_referencepacketstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.