CVE-2019-13272

HIGH(7.8)KEVLikely Exploited

Linux Kernel Improper Privilege Management Vulnerability

Description

CVE-2019-13272 is a high-severity improper privilege management vulnerability in the Linux kernel's ptrace subsystem that allows local users to escalate privileges to root. The flaw exists in kernel/ptrace.c, where the recording of credentials during ptrace relationship creation is mishandled, enabling a local attacker to leverage parent-child process relationships to gain root access. This Linux kernel vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 81.25% (99.2nd percentile), CVE-2019-13272 represents a significant privilege escalation risk for unpatched Linux systems.

KEV Information

Vendor
Linux
Product
Kernel
Date Added
December 10, 2021
Due Date
June 10, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9

Affected Products

VendorProductVersion
linuxlinux kernel>= 3.16.52, < 3.16.71; >= 4.1.39, < 4.2; >= 4.4.40, < 4.4.185; >= 4.8.16, < 4.9; >= 4.9.1, < 4.9.185; >= 4.10, < 4.14.133; >= 4.15, < 4.19.58; >= 4.20, < 5.1.17
debiandebian linux8.0; 9.0; 10.0
fedoraprojectfedora29
canonicalubuntu linux16.04; 18.04; 19.04
redhatenterprise linux7.0; 8.0
redhatenterprise linux for arm 647.0_aarch64
redhatenterprise linux for ibm z systems7.0_s390x
redhatenterprise linux for real time8
redhatenterprise linux for real time for nfv8.0
redhatenterprise linux for real time for nfv tus8.2; 8.4; 8.6; 8.8
redhatenterprise linux for real time tus8.2; 8.4; 8.6; 8.8
netappaff a700s firmware-
netapph410c firmware-
netapph610s firmware-
netappactive iq unified manager-
netappe-series performance analyzer-
netappe-series santricity os controller>= 11.0.0, <= 11.60.3
netapphci management node-
netappservice processor-
netappsolidfire-

Multiple CVSS Assessments

Source: [email protected](Primary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-269: Improper Privilege Management

Improper Privilege Management occurs when a product does not properly assign, modify, track, or check privileges for actors. In the Linux kernel's ptrace subsystem, the vulnerability arises from incorrect privilege tracking during ptrace relationship creation, allowing unprivileged local users to escalate to root through specific parent-child process scenarios involving credential dropping and execve calls.

Learn more: CWE-269 — Improper Privilege Management

Impact Analysis

CVE-2019-13272 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious local privilege escalation threat. The vulnerability requires local access and low-level privileges to exploit, but the attack complexity is low and no user interaction is needed, making it straightforward for any local user to achieve root access. Successful exploitation fully compromises confidentiality, integrity, and availability of the affected system, as the attacker gains complete control with root privileges. The EPSS score of 81.25% indicates a very high likelihood of exploitation. While the attack vector is local rather than network-based, this vulnerability is commonly used as a second-stage exploit after initial access has been gained through another vector, making it a critical component in attack chains targeting Linux infrastructure.

Exploit Maturity

CVE-2019-13272 has a mature exploit landscape with multiple publicly available exploit implementations. Public exploit code is available through multiple sources including Packet Storm Security with a Polkit pkexec-based local root exploit, and additional exploits targeting PTRACE_TRACEME and kernel 5.1.x with pkexec. CISA has confirmed active exploitation in the wild by including this vulnerability in the KEV catalog. The EPSS score of 81.25% (99.2nd percentile) indicates a very high probability of exploitation, and the availability of weaponized exploits through the Project Zero bug tracker further lowers the barrier for attackers.

Remediation

  1. Apply kernel updates immediately as required by CISA KEV: upgrade the Linux kernel to version 5.1.17 or later, which contains the fix for the ptrace credential handling flaw.
  2. Verify affected systems across all Linux distributions including Debian 8.0/9.0/10.0, Ubuntu 16.04/18.04/19.04, Red Hat Enterprise Linux 7.0/8.0, and Fedora 29, ensuring distribution-specific kernel packages have been updated to patched versions.
  3. As an interim mitigation, enable SELinux deny_ptrace policy to restrict ptrace usage, which can prevent exploitation even on unpatched kernels: set kernel.yama.ptrace_scope = 1 or higher via sysctl.
  4. Monitor for indicators of exploitation by reviewing system logs for unusual privilege escalation attempts, unexpected root process creation, and suspicious ptrace-related syscalls using audit frameworks.
  5. Implement defense-in-depth measures by enforcing the principle of least privilege for all user accounts, deploying mandatory access control systems such as SELinux or AppArmor, and regularly auditing user privileges across the environment.

Technical Details

CVE-2019-13272 resides in the ptrace_link function within kernel/ptrace.c of the Linux kernel before version 5.1.17. The vulnerability involves two contributing factors: an object lifetime issue in credential management and incorrect marking of ptrace relationships as privileged. When a parent process drops privileges and calls execve, the kernel fails to properly record the credentials of the process requesting the ptrace relationship, allowing an attacker to exploit this race condition to gain elevated privileges. A practical exploitation path involves leveraging Polkit's pkexec helper with PTRACE_TRACEME, where the attacker's process can inherit or manipulate the privileged credentials of the parent process. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a local attack requiring low privileges, with complete impact on all security dimensions.

Frequently Asked Questions

Is CVE-2019-13272 being actively exploited?

Yes. CVE-2019-13272 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. Multiple public exploits are available on Packet Storm Security and through the Project Zero bug tracker, making this vulnerability widely accessible to attackers.

What products are affected by CVE-2019-13272?

CVE-2019-13272 affects the Linux kernel across multiple version ranges before 5.1.17. Affected distributions include Debian 8.0/9.0/10.0, Ubuntu 16.04/18.04/19.04, Red Hat Enterprise Linux 7.0/8.0, Fedora 29, and various NetApp products running affected kernel versions.

How do I fix CVE-2019-13272?

Update the Linux kernel to version 5.1.17 or later. Apply distribution-specific security patches from your vendor (Debian, Ubuntu, Red Hat, etc.). As an interim mitigation, enable SELinux deny_ptrace or set kernel.yama.ptrace_scope to restrict ptrace usage.

How severe is CVE-2019-13272?

CVE-2019-13272 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access, the low attack complexity and availability of multiple public exploits make it a serious privilege escalation threat. The EPSS score of 81.25% (99.2nd percentile) indicates very high exploitation probability.

CVSS Score

7.8
HIGH(7.8)

EPSS Score

EPSS Score52.20%
EPSS Percentile98.9%

Dates

PublishedJuly 17, 2019
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch