CVE-2019-13272
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a…
Browse: All 2019 CVEs · All vendors
- CVSS score
- 7.8 High
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- CISA KEV
- Yes — actively exploited (added 2021-12-10, remediation due 2022-06-10)
- Weakness (CWE)
- CWE-269
- Published
- 2019-07-17
- Last modified
- 2026-06-17
- NVD status
- Analyzed
Description
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
Affected products
- linux linux kernel
- debian debian linux
- fedoraproject fedora
- canonical ubuntu linux
- redhat enterprise linux
- redhat enterprise linux for arm 64
- redhat enterprise linux for ibm z systems
- redhat enterprise linux for real time
- redhat enterprise linux for real time for nfv
- redhat enterprise linux for real time for nfv tus
- redhat enterprise linux for real time tus
- netapp aff a700s firmware
Affected ranges per NVD CPE data; confirm exact versions in the vendor advisory.
Required action (CISA)
Apply updates per vendor instructions. Federal remediation deadline: 2022-06-10.
How to prioritize this
This vulnerability is on the CISA KEV list, meaning it is being actively exploited — treat it as urgent regardless of the raw CVSS number. Use the live CVE lookup for the latest NVD data, and the CVSS 3.1 calculator to model your own environmental score. For the actively exploited vulnerabilities that matter this week, read The Exploit HQ daily security brief.
References
- http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.html
- http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
- http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.html
- http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html
- http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.html
- https://access.redhat.com/errata/RHSA-2019:2405
- https://access.redhat.com/errata/RHSA-2019:2411
FAQ
Is CVE-2019-13272 actively exploited?
Yes. CISA added CVE-2019-13272 to its Known Exploited Vulnerabilities (KEV) catalog on 2021-12-10, with a federal remediation deadline of 2022-06-10. A KEV listing means real-world exploitation is confirmed, so patching this should be prioritized above many higher-CVSS bugs that aren't being exploited.
What is the CVSS score of CVE-2019-13272?
CVE-2019-13272 has a CVSS base score of 7.8 (High). Its vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Related vulnerabilities
- CVE-2025-39964 — Linux Kernel
- CVE-2026-53266 — Linux Kernel
- CVE-2025-39682 — Linux Kernel
- CVE-2026-53362 — Linux Kernel
- CVE-2022-0995 — Linux Kernel
- CVE-2022-0492 — Linux Kernel
Data source: NVD & CISA KEV. Shown as-is; nothing added. Last generated from NVD data — re-check the live tool for updates.
kev brief
Patch what's actually being exploited.
Subscribe and get the KEV Patch Priority Playbook, free, in your inbox now.
Free. No spam. Unsubscribe anytime. Delivered by Beehiiv.