CVE-2019-13272
Linux Kernel Improper Privilege Management Vulnerability
Published Jul 17, 2019 · updated Jun 16, 2026 · linux linux kernel
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jul 17, 2019 · Catalog
Detected
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing
Dec 10, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing
Required action
Apply updates per vendor instructions.
CISA due date Jun 10, 2022
Affected
- cpe canonical/ubuntu linux16.04
- cpe debian/debian linux8.0
- cpe fedoraproject/fedora29
- cpe linux/linux kernelversion unspecified
- cpe redhat/enterprise linux7.0
- vendor Linux Kernelversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2019-13272
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
cisa.gov - CVE.orgVulnerability recordCVE-2019-13272
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-13272
30-day exploitation probability 52.2%
first.org - Exploit DatabasePublic exploit reference47133
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference47163
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference50541
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_linux/local/ptrace_traceme_pkexec_helper
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2019-13272
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relati
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.html
Packet Storm link already published on the finding.
packetstormsecurity.com