CVE-2019-13272

Warnung

Exploit

EPSS 52.2%
Veröffentlicht 17.07.2019 13:15:10
Zuletzt bearbeitet 06.11.2025 16:51:07
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 0 Referenzen 33

NVD 40 VulnDex Vulnerability Enrichment 9

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version >= 3.16.52 < 3.16.71

Linux ≫ Linux Kernel Version >= 4.1.39 < 4.2

Linux ≫ Linux Kernel Version >= 4.4.40 < 4.4.185

Linux ≫ Linux Kernel Version >= 4.8.16 < 4.9

Linux ≫ Linux Kernel Version >= 4.9.1 < 4.9.185

Linux ≫ Linux Kernel Version >= 4.10 < 4.14.133

Linux ≫ Linux Kernel Version >= 4.15 < 4.19.58

Linux ≫ Linux Kernel Version >= 4.20 < 5.1.17

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Debian ≫ Debian Linux Version10.0

Fedoraproject ≫ Fedora Version29

Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm

Canonical ≫ Ubuntu Linux Version18.04 SwEditionesm

Canonical ≫ Ubuntu Linux Version19.04

Redhat ≫ Enterprise Linux Version7.0

Redhat ≫ Enterprise Linux Version8.0

Redhat ≫ Enterprise Linux For Arm 64 Version7.0_aarch64

Redhat ≫ Enterprise Linux For Ibm Z Systems Version7.0_s390x

Redhat ≫ Enterprise Linux For Real Time Version8

Redhat ≫ Enterprise Linux For Real Time For Nfv Version8.0

Redhat ≫ Enterprise Linux For Real Time For Nfv Tus Version8.2

Redhat ≫ Enterprise Linux For Real Time For Nfv Tus Version8.4

Redhat ≫ Enterprise Linux For Real Time For Nfv Tus Version8.6

Redhat ≫ Enterprise Linux For Real Time For Nfv Tus Version8.8

Redhat ≫ Enterprise Linux For Real Time Tus Version8.2

Redhat ≫ Enterprise Linux For Real Time Tus Version8.4

Redhat ≫ Enterprise Linux For Real Time Tus Version8.6

Redhat ≫ Enterprise Linux For Real Time Tus Version8.8

Netapp ≫ Aff A700s Firmware Version-

Netapp ≫ Aff A700s Version-

Netapp ≫ H410c Firmware Version-

Netapp ≫ H410c Version-

Netapp ≫ H610s Firmware Version-

Netapp ≫ H610s Version-

Netapp ≫ Active Iq Unified Manager Version- SwPlatformvmware_vsphere

Netapp ≫ E-series Performance Analyzer Version-

Netapp ≫ E-series Santricity Os Controller Version >= 11.0.0 <= 11.60.3

Netapp ≫ Hci Management Node Version-

Netapp ≫ Service Processor Version-

Netapp ≫ Solidfire Version-

Netapp ≫ Steelstore Cloud Integrated Storage Version-

Netapp ≫ Hci Compute Node Version-

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

10.12.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Linux Kernel Improper Privilege Management Vulnerability

Schwachstelle

Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	52.2%	0.988

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.2	3.9	10	AV:L/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Es wurden noch keine Informationen zu CWE veröffentlicht.

https://usn.ubuntu.com/4094-1/

Third Party Advisory

https://usn.ubuntu.com/4118-1/

Third Party Advisory

http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html

Third Party Advisory

Exploit

VDB Entry

https://usn.ubuntu.com/4095-1/

Third Party Advisory

http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

Third Party Advisory

VDB Entry

https://seclists.org/bugtraq/2019/Jul/33

Third Party Advisory

Mailing List

Issue Tracking

https://access.redhat.com/errata/RHSA-2019:2809

Third Party Advisory

https://usn.ubuntu.com/4117-1/

Third Party Advisory

https://usn.ubuntu.com/4093-1/

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2019/07/msg00022.html

Third Party Advisory

Mailing List

https://seclists.org/bugtraq/2019/Jul/30

Third Party Advisory

Mailing List

Issue Tracking

https://security.netapp.com/advisory/ntap-20190806-0001/

Third Party Advisory

http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.html

Third Party Advisory

VDB Entry

http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.html

Third Party Advisory

Exploit

VDB Entry

http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html

Third Party Advisory

Exploit

VDB Entry

http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.html

Third Party Advisory

Exploit

VDB Entry

https://access.redhat.com/errata/RHSA-2019:2405

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2411

Third Party Advisory

https://bugs.chromium.org/p/project-zero/issues/detail?id=1903

Patch

Third Party Advisory

Exploit

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1730895

Patch

Issue Tracking

https://bugzilla.suse.com/show_bug.cgi?id=1140671

Patch

Third Party Advisory

Issue Tracking

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17

Patch

Vendor Advisory

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41ee

Patch

Vendor Advisory

https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee

Patch

https://lists.debian.org/debian-lts-announce/2019/07/msg00023.html

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK5LYWBJ4E4SRI4DKX367NHYSI3VOH/

Release Notes

https://support.f5.com/csp/article/K91025336

Third Party Advisory

https://support.f5.com/csp/article/K91025336?utm_source=f5support&amp%3Butm_medium=RSS

Third Party Advisory

https://www.debian.org/security/2019/dsa-4484

Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-13272

US Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2019-13272

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-13272

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-13272

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-13272

10.12.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog