CVE-2019-13272
Linux Kernel Improper Privilege Management Vulnerability
Published Jul 17, 2019 · updated Jun 16, 2026 · linux linux kernel
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
Timeline
Detection, updates, and resolution for this record.
Jul 17, 2019 · Catalog
Detected
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing
Dec 10, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing
Required action
Apply updates per vendor instructions.
CISA due date Jun 10, 2022
Affected
- cpe canonical/ubuntu linux16.04
- cpe debian/debian linux8.0
- cpe fedoraproject/fedora29
- cpe linux/linux kernelversion unspecified
- cpe redhat/enterprise linux7.0
- vendor Linux Kernelversion unspecified
Sources
- CISA KEVCVE-2019-13272
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
cisa.gov - CVE.orgCVE-2019-13272
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-13272
30-day exploitation probability 52.2%
first.org - Exploit Database47133
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47163
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database50541
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_linux/local/ptrace_traceme_pkexec_helper
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2019-13272
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relati
nvd.nist.gov