In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACETRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-13272.json"
[
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6994eefb0053799d2e07cd140df6c2ea106c41ee",
"target": {
"file": "kernel/ptrace.c"
},
"deprecated": false,
"id": "CVE-2019-13272-546b25a9",
"digest": {
"line_hashes": [
"26913659160089144023271183334299731944",
"267897109582351749036434203915707344829",
"31920921196100191837100119415394897960",
"145880967429936438507621350861356760219",
"334914623103324396839068184442899313075",
"216108277631963224586513787819566708543"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6994eefb0053799d2e07cd140df6c2ea106c41ee",
"target": {
"function": "ptrace_link",
"file": "kernel/ptrace.c"
},
"deprecated": false,
"id": "CVE-2019-13272-600e1be3",
"digest": {
"length": 139.0,
"function_hash": "99998485996578718793097978405192806275"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-13272.json"
[
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee",
"target": {
"function": "ptrace_link",
"file": "kernel/ptrace.c"
},
"deprecated": false,
"id": "CVE-2019-13272-d8d21238",
"digest": {
"length": 139.0,
"function_hash": "99998485996578718793097978405192806275"
}
},
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee",
"target": {
"file": "kernel/ptrace.c"
},
"deprecated": false,
"id": "CVE-2019-13272-f52817e3",
"digest": {
"line_hashes": [
"26913659160089144023271183334299731944",
"267897109582351749036434203915707344829",
"31920921196100191837100119415394897960",
"145880967429936438507621350861356760219",
"334914623103324396839068184442899313075",
"216108277631963224586513787819566708543"
],
"threshold": 0.9
}
}
]