CVE-2019-13272

HIGH KEV

Linux Polkit pkexec helper PTRACE_TRACEME local root exploit

Title source: metasploit

Description

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Exploits (28)

nomisec WORKING POC 328 stars
by jas502n · local
https://github.com/jas502n/CVE-2019-13272
github WORKING POC 8 stars
by codecat007 · cpoc
https://github.com/codecat007/cvehub/tree/main/android/kernel/EXP-CVE-2019-13272
nomisec WORKING POC 5 stars
by Cyc1eC · local
https://github.com/Cyc1eC/CVE-2019-13272
nomisec WORKING POC 4 stars
by oneoy · local
https://github.com/oneoy/CVE-2019-13272
nomisec WORKING POC 2 stars
by MDS1GNAL · local
https://github.com/MDS1GNAL/ptrace_scope-CVE-2019-13272-privilege-escalation
nomisec WRITEUP 2 stars
by Tharana · poc
https://github.com/Tharana/vulnerability-exploitation
nomisec WORKING POC 2 stars
by josemlwdf · local
https://github.com/josemlwdf/CVE-2019-13272
nomisec SUSPICIOUS 1 stars
by Tharana · poc
https://github.com/Tharana/Exploiting-a-Linux-kernel-vulnerability
nomisec NO CODE 1 stars
by bigbigliang-malwarebenchmark · poc
https://github.com/bigbigliang-malwarebenchmark/cve-2019-13272
nomisec NO CODE
by teddy47 · poc
https://github.com/teddy47/CVE-2019-13272---Documentation
nomisec SUSPICIOUS
by GgKendall · poc
https://github.com/GgKendall/secureCodingDemo
nomisec WORKING POC
by polosec · local
https://github.com/polosec/CVE-2019-13272
nomisec STUB
by sumedhaDharmasena · poc
https://github.com/sumedhaDharmasena/-Kernel-ptrace-c-mishandles-vulnerability-CVE-2019-13272
nomisec WRITEUP
by datntsec · poc
https://github.com/datntsec/CVE-2019-13272
nomisec NO CODE
by jana30116 · poc
https://github.com/jana30116/CVE-2019-13272-Local-Privilege-Escalation
nomisec WORKING POC
by Chinmay1743 · poc
https://github.com/Chinmay1743/ptrace-vuln
nomisec STUB
by RashmikaEkanayake · poc
https://github.com/RashmikaEkanayake/Privilege-Escalation-CVE-2019-13272-
github NO CODE
by DanukaNuwan · poc
https://github.com/DanukaNuwan/CVE-Exploits/tree/main/CVE-2019-13272.pdf
nomisec WORKING POC
by babyshen · local
https://github.com/babyshen/CVE-2019-13272
nomisec WORKING POC
by asepsaepdin · local
https://github.com/asepsaepdin/CVE-2019-13272
nomisec WORKING POC
by letsr00t · local
https://github.com/letsr00t/CVE-2019-13272
metasploit WORKING POC EXCELLENT
by Jann Horn, bcoles, timwr · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ptrace_traceme_pkexec_helper.rb
exploitdb WORKING POC
by Ujas Dhami · clocallinux
https://www.exploit-db.com/exploits/50541
exploitdb WORKING POC VERIFIED
by Google Security Research · textlocallinux
https://www.exploit-db.com/exploits/47133
exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/47543
exploitdb WORKING POC
by bcoles · clocallinux
https://www.exploit-db.com/exploits/47163

References (30)

... and 10 more

Scores

CVSS v3 7.8
EPSS 0.8125
EPSS Percentile 99.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Intel

CISA KEV 2021-12-10
VulnCheck KEV 2021-12-10
InTheWild.io 2021-12-10
ENISA EUVD EUVD-2019-4779

Classification

Status published

Affected Products (33)

linux/linux_kernel < 3.16.71
debian/debian_linux
debian/debian_linux
debian/debian_linux
fedoraproject/fedora
canonical/ubuntu_linux
canonical/ubuntu_linux
canonical/ubuntu_linux
redhat/enterprise_linux
redhat/enterprise_linux
redhat/enterprise_linux_for_arm_64
redhat/enterprise_linux_for_ibm_z_systems
redhat/enterprise_linux_for_real_time
redhat/enterprise_linux_for_real_time_for_nfv
redhat/enterprise_linux_for_real_time_for_nfv_tus
... and 18 more

Timeline

Published Jul 17, 2019
KEV Added Dec 10, 2021
Tracked Since Feb 18, 2026