CVE-2019-13272

HIGH KEV

Linux Polkit pkexec helper PTRACE_TRACEME local root exploit

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2019-13272 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 10, 2021. EIP tracks 26 public exploits from researchers including Metasploit, Google Security Research, Ujas Dhami, including a Metasploit module exploits/linux/local/ptrace_traceme_pkexec_helper.

AI-analyzed exploit summary This Metasploit module exploits CVE-2019-13272, a local privilege escalation vulnerability in the Linux kernel's ptrace_link function. It leverages Polkit's pkexec helper with PTRACE_TRACEME to gain root access on vulnerable systems.

Description

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Exploits (26)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/47543

This Metasploit module exploits CVE-2019-13272, a local privilege escalation vulnerability in the Linux kernel's ptrace_link function. It leverages Polkit's pkexec helper with PTRACE_TRACEME to gain root access on vulnerable systems.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel before 5.1.17, 4.19.58, 4.14.133, 4.9.185, 4.4.185
Auth required
Prerequisites: Local access to a vulnerable Linux system · Active Polkit agent session · Non-SSH terminal access
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Google Security Research · textlocallinux
https://www.exploit-db.com/exploits/47133

This exploit demonstrates a privilege escalation vulnerability in the Linux kernel (CVE-2019-13272) by abusing the PTRACE_TRACEME mechanism to create a privileged ptrace relationship, leading to potential root access. The PoC triggers a kernel panic due to incorrect credential handling.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel versions 4.10 and later (with backports to older versions)
No auth needed
Prerequisites: A system with a vulnerable Linux kernel · A setuid binary that drops privileges and becomes dumpable
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Ujas Dhami · clocallinux
https://www.exploit-db.com/exploits/50541

This exploit leverages CVE-2019-13272, a race condition in the Linux kernel's ptrace implementation, to escalate privileges via pkexec. It manipulates process tracing and memory injection to spawn a root shell.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux Kernel 4.19 - 5.2.1
No auth needed
Prerequisites: Access to a vulnerable Linux system · Presence of pkexec and a compatible PolKit helper binary
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by bcoles · clocallinux
https://www.exploit-db.com/exploits/47163

This exploit leverages CVE-2019-13272, a PTRACE_TRACEME vulnerability in Linux kernels 4.10 to 5.1.17, to achieve local privilege escalation (LPE) by manipulating the ptrace relationship during the execution of pkexec. It spawns a root shell by exploiting improper credential handling in the ptrace subsystem.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel 4.10 < 5.1.17
No auth needed
Prerequisites: Local user access · Presence of a known helper binary (e.g., mate-power-backlight-helper) · pkexec installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 328 stars
by jas502n · local
https://github.com/jas502n/CVE-2019-13272

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2019-13272, leveraging a PTRACE_TRACEME race condition in Linux kernels 4.10 to 5.1.17. The exploit uses pkexec to gain root privileges by manipulating process tracing and SUID execution.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel 4.10 < 5.1.17
Auth required
Prerequisites: Local user access · Presence of a known helper binary (e.g., mate-power-backlight-helper)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC 8 stars
by codecat007 · cpoc
https://github.com/codecat007/cvehub/tree/main/android/kernel/EXP-CVE-2019-13272

This repository contains a functional local privilege escalation exploit for CVE-2019-13272, leveraging a PTRACE_TRACEME race condition in Linux kernels 4.10 to 5.1.17. The exploit uses a multi-stage approach with fake pkexec and helper binaries to gain root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel 4.10 < 5.1.17
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compilation of the exploit and helper binaries
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 5 stars
by Cyc1eC · local
https://github.com/Cyc1eC/CVE-2019-13272

This repository contains a functional exploit for CVE-2019-13272, a Linux local privilege escalation vulnerability affecting kernels below 5.1.17. The exploit leverages a ptrace-based race condition in pkexec to gain root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel < 5.1.17 with PolKit
Auth required
Prerequisites: PolKit installed · pkexec available · active PolKit agent session
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by oneoy · local
https://github.com/oneoy/CVE-2019-13272

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2019-13272, leveraging a PTRACE_TRACEME vulnerability in Linux kernels 4.10 to 5.1.17. The exploit uses pkexec to gain root access by manipulating process tracing and SUID execution.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel 4.10 < 5.1.17
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Presence of a known helper binary (e.g., mate-power-backlight-helper)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by josemlwdf · local
https://github.com/josemlwdf/CVE-2019-13272

This is a functional exploit for CVE-2019-13272, a local privilege escalation vulnerability in Polkit's pkexec. The exploit leverages improper handling of environment variables and argument injection to gain root privileges by manipulating the execution flow of pkexec.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Polkit pkexec (versions before 0.105)
Auth required
Prerequisites: Local access to a vulnerable system · Presence of a vulnerable pkexec binary · A valid user session with a Polkit agent running
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by MDS1GNAL · local
https://github.com/MDS1GNAL/ptrace_scope-CVE-2019-13272-privilege-escalation

The repository contains a functional privilege escalation exploit for CVE-2019-13272, leveraging a ptrace scope bypass in Linux systems. The exploit uses GDB to inject commands into running shell processes to escalate privileges.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (ptrace scope misconfiguration)
Auth required
Prerequisites: GDB installed · User with shell access
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP 2 stars
by Tharana · poc
https://github.com/Tharana/vulnerability-exploitation

The repository contains a README.md file mentioning multiple CVEs, including CVE-2015-1538 (Stagefright RCE), but lacks actual exploit code or technical details. It appears to be a placeholder or incomplete writeup.

Classification
Writeup 30%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Google Android (Stagefright)
No auth needed
Prerequisites: none specified
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SUSPICIOUS 1 stars
by Tharana · poc
https://github.com/Tharana/Exploiting-a-Linux-kernel-vulnerability

The repository lacks exploit code or technical details, instead providing vague descriptions and requesting external review. No functional PoC or analysis is included.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Linux kernel (unspecified version)
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec NO CODE 1 stars
by bigbigliang-malwarebenchmark · poc
https://github.com/bigbigliang-malwarebenchmark/cve-2019-13272
nomisec WORKING POC
by letsr00t · local
https://github.com/letsr00t/CVE-2019-13272

This repository contains a functional exploit for CVE-2019-13272, a local privilege escalation vulnerability in Linux kernels 4.10 to 5.1.17. The exploit leverages the PTRACE_TRACEME mechanism and pkexec to gain root privileges by manipulating process tracing relationships.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel versions 4.10 to 5.1.17
No auth needed
Prerequisites: Access to a vulnerable Linux system · Presence of a suitable helper binary (e.g., mate-power-backlight-helper)
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by Chinmay1743 · poc
https://github.com/Chinmay1743/ptrace-vuln

The repository contains a functional PoC for CVE-2019-13272, demonstrating the ptrace vulnerability by tracing system calls in a child process. The code compiles and runs, showing system call numbers and confirming the vulnerability's applicability on unhardened systems.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Linux kernel (versions affected by CVE-2019-13272)
No auth needed
Prerequisites: Unpatched Linux kernel · ptrace not restricted
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by asepsaepdin · local
https://github.com/asepsaepdin/CVE-2019-13272

This repository contains a functional exploit for CVE-2019-13272, a local privilege escalation vulnerability in Polkit's pkexec. The exploit leverages a ptrace race condition to gain root access by manipulating process credentials during a privileged execution.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Polkit pkexec (Linux kernel before 5.1.17)
No auth needed
Prerequisites: Local access to a vulnerable system · Presence of pkexec binary
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SUSPICIOUS
by GgKendall · poc
https://github.com/GgKendall/secureCodingDemo

The repository lacks exploit code and instead references external links in a .txt file, which is a common tactic for suspicious repos. No technical details about CVE-2019-13272 are provided.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Linux Kernel (version unspecified)
No auth needed
Prerequisites: access to external links mentioned in the .txt file
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by babyshen · local
https://github.com/babyshen/CVE-2019-13272

This is a functional local privilege escalation (LPE) exploit for CVE-2019-13272, leveraging a ptrace race condition in Linux kernels 4.10 to 5.1.17. It uses pkexec to spawn a privileged process and manipulates ptrace relationships to gain root access.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel 4.10 < 5.1.17
Auth required
Prerequisites: User session with active PolKit agent · kernel.yama.ptrace_scope < 2 · SELinux deny_ptrace=off
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by datntsec · poc
https://github.com/datntsec/CVE-2019-13272

This repository provides a detailed technical analysis of CVE-2019-13272, a local privilege escalation vulnerability in the Linux kernel related to the PTRACE_TRACEME system call. It includes root cause analysis, code snippets, and explanations of the ptrace mechanism and credential handling.

Classification
Writeup 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Theoretical
Target: Linux Kernel (versions affected by CVE-2019-13272)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Ability to execute processes
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by RashmikaEkanayake · poc
https://github.com/RashmikaEkanayake/Privilege-Escalation-CVE-2019-13272-

The repository contains only a README with a brief description of CVE-2019-13272 but no exploit code, technical details, or analysis. It appears to be a placeholder or incomplete submission.

Classification
Stub 90%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Linux kernel (specific version not specified)
Auth required
Prerequisites: Local access to a vulnerable system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by sumedhaDharmasena · poc
https://github.com/sumedhaDharmasena/-Kernel-ptrace-c-mishandles-vulnerability-CVE-2019-13272

The repository contains only a minimal README with a CVE identifier and no functional exploit code or technical details. It appears to be a placeholder or incomplete submission.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Linux Kernel (ptrace)
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by polosec · local
https://github.com/polosec/CVE-2019-13272

This Python script exploits CVE-2019-13272, a command injection vulnerability in the PTZ (Pan-Tilt-Zoom) camera management interface. It sends a maliciously crafted HTTP POST request with encoded commands to achieve remote code execution (RCE) on the target device.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: PTZ camera management interface (specific vendor/model not specified in code)
No auth needed
Prerequisites: Network access to the target device · Vulnerable PTZ camera firmware
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Jann Horn, bcoles, timwr · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ptrace_traceme_pkexec_helper.rb

This Metasploit module exploits CVE-2019-13272, a local privilege escalation vulnerability in the Linux kernel's ptrace_link function. It leverages Polkit's pkexec helper with PTRACE_TRACEME to gain root access on vulnerable systems.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel before 5.1.17 (and backported patches in 4.4.185, 4.9.185, 4.14.133, 4.19.58)
Auth required
Prerequisites: Local access to a vulnerable Linux system · Active Polkit agent session · x86_64 architecture · pkexec installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (30)

Core 30
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
Patch, Vendor Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.suse.com/show_bug.cgi?id=1140671
Issue Tracking, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1730895
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4484
Issue Tracking, Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Jul/30
Issue Tracking, Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Jul/33
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/07/msg00022.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/07/msg00023.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190806-0001/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2405
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2411
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4093-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4094-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4095-1/
Third Party Advisory x_refsource_confirm
https://support.f5.com/csp/article/K91025336
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4117-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4118-1/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2809
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html

Scores

CVSS v3 7.8
EPSS 0.8038
EPSS Percentile 99.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-12-10
VulnCheck KEV 2021-12-10
InTheWild.io 2021-12-10
ENISA EUVD EUVD-2019-4779
Status published
Products (33)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.04
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 29
linux/linux_kernel 3.16.52 - 3.16.71
netapp/active_iq_unified_manager
netapp/aff_a700s_firmware
... and 23 more
Published Jul 17, 2019
KEV Added Dec 10, 2021
Tracked Since Feb 18, 2026