CVE-2019-13272 Linux Kernel Improper Privilege Management
Local attackers can gain root privileges via ptrace mishandling in the Linux kernel, potentially causing system panics.
- Exploited in the wild
- Since 10 Dec 2021
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-13272?
CVE-2019-13272 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 17 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
Which versions are affected by CVE-2019-13272?
It affects 22 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Linux kernel, Netapp Active Iq Unified Manager, Netapp Aff A700s Firmware and 16 more.
How do I fix CVE-2019-13272?
Apply the vendor's patch. US federal agencies must fix it by 10 Jun 2022.
Is CVE-2019-13272 being exploited?
Yes. Attackers have exploited CVE-2019-13272 in the wild since at least 10 Dec 2021.
Public exploit code: 1 Metasploit module, 4 Exploit-DB entries and 19 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2019-13272, DLA-1863-1, DSA-4484-1, GHSA-87j5-gppq-mq6h, UBUNTU-CVE-2019-13272.