CVE-2019-13272

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is a flaw in the Linux kernel prior to version 5.1.17 within the ptrace_link function in kernel/ptrace.c. It stems from improper handling of credential recording when establishing a ptrace relationship, combined with an object lifetime issue and incorrect privilege marking on the relationship. This affects local process interactions on affected kernels and can be triggered through mechanisms such as Polkit's pkexec helper using PTRACE_TRACEME.

Local users can exploit the issue in scenarios involving a parent-child process relationship where the parent drops privileges before calling execve. Successful exploitation grants the attacker root privileges on the system, with a CVSS score of 7.8 reflecting high impact on confidentiality, integrity, and availability from a local, low-complexity attack.

Advisories referenced in the CVE, including Slackware kernel updates and Canonical kernel live patch notices, indicate that mitigation is achieved by applying the upstream kernel patch to version 5.1.17 or later. The description also notes that SELinux with deny_ptrace enabled may serve as a partial workaround in certain environments. Public exploit code for the PTRACE_TRACEME local root technique has been published, confirming practical exploitability on unpatched systems.