cbcvebase.
CVE-2019-13272
published 2019-07-17

CVE-2019-13272: In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace…

PriorityP185high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-10
Exploited in the wild
EPSS
52.20%
98.8th percentile
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debiandebian_linux
debianlinux< linux 4.19.37-6 (bookworm)linux 4.19.37-6 (bookworm)
fedoraprojectfedora
linuxlinux_kernel>= 0 < 4.19.37-64.19.37-6
linuxlinux_kernel>= 0 < 4.19.37-64.19.37-6
linuxlinux_kernel>= 0 < 4.19.37-64.19.37-6
linuxlinux_kernel>= 0 < 4.19.37-64.19.37-6
linuxlinux_kernel>= 0 < 4.4.0-159.1874.4.0-159.187
linuxlinux_kernel>= 0 < 4.15.0-58.644.15.0-58.64
linuxlinux_kernel>= 3.16.52 < 3.16.713.16.71
linuxlinux_kernel>= 4.1.39 < 4.24.2
linuxlinux_kernel>= 4.10 < 4.14.1334.14.133
linuxlinux_kernel>= 4.15 < 4.19.584.19.58
linuxlinux_kernel>= 4.20 < 5.1.175.1.17
linuxlinux_kernel>= 4.4.40 < 4.4.1854.4.185
linuxlinux_kernel>= 4.8.16 < 4.94.9
linuxlinux_kernel>= 4.9.1 < 4.9.1854.9.185
netappe-series_santricity_os_controller11.0.0 – 11.60.3
redhatenterprise_linux
redhatenterprise_linux

Detection & IOCsextracted from sources · hover to see the quote

path/usr/bin/pkexec
path/usr/bin/pkaction
path/usr/lib/gnome-settings-daemon/gsd-backlight-helper
path/usr/lib/gnome-settings-daemon/gsd-wacom-led-helper
path/usr/lib/unity-settings-daemon/usd-backlight-helper
path/usr/lib/x86_64-linux-gnu/xfce4/session/xfsm-shutdown-helper
path/usr/sbin/mate-power-backlight-helper
path/usr/bin/xfpm-power-backlight-helper
path/usr/bin/lxqt-backlight_backend
path/usr/libexec/gsd-wacom-led-helper
path/usr/libexec/gsd-wacom-oled-helper
path/usr/libexec/gsd-backlight-helper
path/usr/lib/gsd-backlight-helper
path/usr/lib/gsd-wacom-led-helper
path/usr/lib/gsd-wacom-oled-helper
urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47133.zip
urlhttps://github.com/bcoles/kernel-exploits/tree/master/CVE-2019-13272
urlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1903
commandptrace(PTRACE_TRACEME, 0, NULL, NULL)
  • Alert on processes reading /proc/<pid>/status in a tight loop while simultaneously calling PTRACE_TRACEME — this is the exploit's synchronization mechanism to detect when the parent has elevated UID.
  • Monitor for clone() calls with CLONE_VM|CLONE_VFORK|SIGCHLD flags followed immediately by pkexec execution — this is the exploit's method to spawn the privileged middle process.
  • Detect PTRACE_ATTACH to a process that previously executed pkexec (suid), followed by injecting execve via PTRACE_SYSCALL/PTRACE_SETREGSET — this is the exploit's privilege escalation stage.
  • Flag processes invoking pkexec with '--user <current_user> <helper_path> --help' arguments — this is the exploit's pattern for triggering the polkit helper execution.
  • Monitor for execution of known polkit helper binaries (e.g. gsd-backlight-helper, xfsm-shutdown-helper, mate-power-backlight-helper) spawned from unexpected parent processes — these are the exploit's target suid helpers.
  • The exploit checks for SELinux deny_ptrace before proceeding; alert on execution of '/usr/sbin/getsebool deny_ptrace' from non-administrative processes as a pre-exploitation reconnaissance indicator.
  • The exploit requires an active Polkit agent and will not work over SSH; detection should focus on local desktop sessions. The Metasploit module checks 'loginctl show-session $XDG_SESSION_ID | grep Remote' to confirm this.
  • The exploit drops a randomly-named hidden payload file (dot-prefixed, 6-12 random alpha chars) in a writable directory (default /tmp) and chmod+x's it; monitor for creation of hidden executables in /tmp.
  • The exploit uses 'org.freedesktop.policykit.exec.path' as a search needle when parsing pkaction --verbose output to enumerate viable helper paths; monitor for pkaction --verbose invocations from non-root processes.
  • Kernel panic signature for the object lifetime bug: look for 'CRED: put_cred_rcu() sees ... with usage 1' in kernel logs as an indicator of attempted exploitation of the race condition variant.
  • Vulnerable kernel versions range from 4.10 (commit introduction) up to but not including 4.4.185, 4.9.185, 4.14.133, 4.19.58, and 5.1.17; use kernel version checks to identify unpatched systems.
  • ·The exploit requires execution from within an active local desktop session with a Polkit agent running; it cannot be exploited over SSH.
  • ·SELinux deny_ptrace policy can mitigate this vulnerability in some environments.
  • ·The Metasploit module defaults to linux/x64/meterpreter/reverse_tcp payload with PrependFork enabled; only x86_64 architecture is supported.
  • ·The exploit requires a suitable polkit helper binary (suid, drops privileges, becomes dumpable) to be present on the system; if none of the known helpers exist, it falls back to enumerating pkaction policies.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck7.8HIGH
cisa7.8HIGH
vendor_ubuntu9.8CRITICAL
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.