Strix
26.1K

CVE-2019-13272

HIGHCVSS 7.8/10Actively ExploitedEPSS 52.20%

Last modified

CVE-2019-13272 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). CISA has confirmed active exploitation in the wild. EPSS estimates a 52.20% chance of exploitation in the next 30 days.

Description

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
52.20%

98.8th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Affected Software

VendorProductVersions
LinuxLinux Kernel>= 3.16.52, < 3.16.71
LinuxLinux Kernel>= 4.1.39, < 4.2
LinuxLinux Kernel>= 4.4.40, < 4.4.185
LinuxLinux Kernel>= 4.8.16, < 4.9
LinuxLinux Kernel>= 4.9.1, < 4.9.185
LinuxLinux Kernel>= 4.10, < 4.14.133
LinuxLinux Kernel>= 4.15, < 4.19.58
LinuxLinux Kernel>= 4.20, < 5.1.17
DebianDebian Linux8.0
DebianDebian Linux9.0
DebianDebian Linux10.0
FedoraprojectFedora29
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
CanonicalUbuntu Linux19.04
RedhatEnterprise Linux7.0
RedhatEnterprise Linux8.0
RedhatEnterprise Linux For Arm 647.0_aarch64
RedhatEnterprise Linux For Ibm Z Systems7.0_s390x
RedhatEnterprise Linux For Real Time8
RedhatEnterprise Linux For Real Time For Nfv8.0
RedhatEnterprise Linux For Real Time For Nfv Tus8.2
RedhatEnterprise Linux For Real Time For Nfv Tus8.4
RedhatEnterprise Linux For Real Time For Nfv Tus8.6
RedhatEnterprise Linux For Real Time For Nfv Tus8.8
RedhatEnterprise Linux For Real Time Tus8.2
RedhatEnterprise Linux For Real Time Tus8.4
RedhatEnterprise Linux For Real Time Tus8.6
RedhatEnterprise Linux For Real Time Tus8.8
NetappAff A700s FirmwareAll versions
NetappH410c FirmwareAll versions
NetappH610s FirmwareAll versions
NetappActive Iq Unified ManagerAll versions
NetappE-Series Performance AnalyzerAll versions
NetappE-Series Santricity Os Controller>= 11.0.0, <= 11.60.3
NetappHci Management NodeAll versions
NetappService ProcessorAll versions
NetappSolidfireAll versions
NetappSteelstore Cloud Integrated StorageAll versions
NetappHci Compute NodeAll versions

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2019-13272?
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
How severe is CVE-2019-13272?
CVE-2019-13272 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 52.20% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2019-13272?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-13272?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST