Known exploited vulnerability
CVE-2019-13272
The short answer
CVE-2019-13272 affects n/a n/a and is rated high (CVSS 7.8). CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10: attackers are using it, so patch it first. The vendor has linked a patch.
What it is
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
Severity
7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploited (CISA KEV)
Yes, since Dec 10, 2021
Federal due date Jun 10, 2022
EPSS, next 30 days
52%
Higher than 99% of scored CVEs
How it can be exploited
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
What CISA says to do
Apply updates per vendor instructions.
Affected products
n/a. NVD's record lists the exact affected versions.
References
- access.redhat.com/errata/RHSA-2019:2405 Third Party Advisory
- access.redhat.com/errata/RHSA-2019:2411 Third Party Advisory
- access.redhat.com/errata/RHSA-2019:2809 Third Party Advisory
- bugs.chromium.org/p/project-zero/issues/detail?id=1903 ExploitIssue TrackingPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1730895 Issue TrackingPatch
- bugzilla.suse.com/show_bug.cgi?id=1140671 Issue TrackingPatchThird Party Advisory
- cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17 PatchVendor Advisory
- git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41ee PatchVendor Advisory
- github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee Patch
- lists.debian.org/debian-lts-announce/2019/07/msg00022.html Mailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/07/msg00023.html Mailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK5LYWBJ4E4SRI4DKX367NHYSI3VOH/ Release Notes
Questions
Is CVE-2019-13272 being exploited?
Yes. CISA added CVE-2019-13272 to its Known Exploited Vulnerabilities catalog on 2021-12-10, with a federal remediation due date of 2022-06-10.
How do I fix CVE-2019-13272?
CISA's required action: Apply updates per vendor instructions.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Analyzed. The description is NVD's text, quoted as published.
Related
Latest CVEs this week
Critical and High CVEs from the last 7 days, with KEV and EPSS.
Exploited vulnerabilities by vendor
Every vendor in CISA's KEV catalog, with its count.
Linux exploited vulnerabilities
Everything CISA lists as exploited for Linux.
Vulnerability watch
A briefing and a fix pull request when an advisory hits your dependencies.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.