SECUFOCUSNOW
Home›CVE index›CVE-2019-13272
CISA KEV · Known exploitedHigh

CVE-2019-13272

Linux Kernel

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for exampl...

CVSS
7.8
EPSS
52.2%
98.8% percentile
CISA KEV
Listed
Published
2019.07.17
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability52.2%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for exampl...

Affected product and versions

Product
Linux Kernel
Affected versions
>= 3.16.52 < 3.16.71, >= 4.1.39 < 4.2, >= 4.4.40 < 4.4.185, >= 4.8.16 < 4.9, >= 4.9.1 < 4.9.185, >= 4.10 < 4.14.133, >= 4.15 < 4.19.58, >= 4.20 < 5.1.17, 8.0, 9.0, 10.0, 29, 16.04, 18.04, 19.04, 7.0, 7.0 aarch64, 7.0 s390x, 8
Fixed versions
3.16.71, 4.2, 4.4.185, 4.9, 4.9.185, 4.14.133, 4.19.58, 5.1.17

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply updates per vendor instructions.

Due date: 2022.06.10
  1. 1
    Identify

    Confirm that Linux Kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-269
KEV added
2021.12.10
Ransomware use
미확인
CVE-2019-13272 — Linux Kernel | SECUFOCUS NOW