CVE-2019-13272

HIGH KEV

Linux Polkit pkexec helper PTRACE_TRACEME local root exploit

Title source: metasploit

Description

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Exploits (28)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/47543
exploitdb WORKING POC VERIFIED
by Google Security Research · textlocallinux
https://www.exploit-db.com/exploits/47133
exploitdb WORKING POC
by Ujas Dhami · clocallinux
https://www.exploit-db.com/exploits/50541
exploitdb WORKING POC
by bcoles · clocallinux
https://www.exploit-db.com/exploits/47163
nomisec WORKING POC 328 stars
by jas502n · local
https://github.com/jas502n/CVE-2019-13272
github WORKING POC 8 stars
by codecat007 · cpoc
https://github.com/codecat007/cvehub/tree/main/android/kernel/EXP-CVE-2019-13272
nomisec WORKING POC 5 stars
by Cyc1eC · local
https://github.com/Cyc1eC/CVE-2019-13272
nomisec WORKING POC 4 stars
by oneoy · local
https://github.com/oneoy/CVE-2019-13272
nomisec WORKING POC 2 stars
by josemlwdf · local
https://github.com/josemlwdf/CVE-2019-13272
nomisec WORKING POC 2 stars
by MDS1GNAL · local
https://github.com/MDS1GNAL/ptrace_scope-CVE-2019-13272-privilege-escalation
nomisec WRITEUP 2 stars
by Tharana · poc
https://github.com/Tharana/vulnerability-exploitation
nomisec SUSPICIOUS 1 stars
by Tharana · poc
https://github.com/Tharana/Exploiting-a-Linux-kernel-vulnerability
nomisec NO CODE 1 stars
by bigbigliang-malwarebenchmark · poc
https://github.com/bigbigliang-malwarebenchmark/cve-2019-13272
nomisec WORKING POC
by letsr00t · local
https://github.com/letsr00t/CVE-2019-13272
nomisec WORKING POC
by Chinmay1743 · poc
https://github.com/Chinmay1743/ptrace-vuln
github NO CODE
by DanukaNuwan · poc
https://github.com/DanukaNuwan/CVE-Exploits/tree/main/CVE-2019-13272.pdf
nomisec WORKING POC
by asepsaepdin · local
https://github.com/asepsaepdin/CVE-2019-13272
nomisec SUSPICIOUS
by GgKendall · poc
https://github.com/GgKendall/secureCodingDemo
nomisec WORKING POC
by babyshen · local
https://github.com/babyshen/CVE-2019-13272
nomisec NO CODE
by jana30116 · poc
https://github.com/jana30116/CVE-2019-13272-Local-Privilege-Escalation
nomisec WRITEUP
by datntsec · poc
https://github.com/datntsec/CVE-2019-13272
nomisec NO CODE
by teddy47 · poc
https://github.com/teddy47/CVE-2019-13272---Documentation
nomisec STUB
by RashmikaEkanayake · poc
https://github.com/RashmikaEkanayake/Privilege-Escalation-CVE-2019-13272-
nomisec STUB
by sumedhaDharmasena · poc
https://github.com/sumedhaDharmasena/-Kernel-ptrace-c-mishandles-vulnerability-CVE-2019-13272
nomisec WORKING POC
by polosec · local
https://github.com/polosec/CVE-2019-13272
metasploit WORKING POC EXCELLENT
by Jann Horn, bcoles, timwr · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ptrace_traceme_pkexec_helper.rb

References (30)

... and 10 more

Scores

CVSS v3 7.8
EPSS 0.8056
EPSS Percentile 99.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2021-12-10
VulnCheck KEV 2021-12-10
InTheWild.io 2021-12-10
ENISA EUVD EUVD-2019-4779
Status published
Products (33)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.04
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 29
linux/linux_kernel 3.16.52 - 3.16.71
netapp/active_iq_unified_manager
netapp/aff_a700s_firmware
... and 23 more
Published Jul 17, 2019
KEV Added Dec 10, 2021
Tracked Since Feb 18, 2026