Linux Kernel up to 5.1.16 kernel/ptrace.c access control

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.1.16. The affected element is an unknown function of the file kernel/ptrace.c. The manipulation results in access control. This vulnerability is known as CVE-2019-13272. Attacking locally is a requirement. Furthermore, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.1.16 (Operating System). It has been classified as critical. Affected is some unknown functionality of the file kernel/ptrace.c. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

The weakness was published 07/17/2019 as Bug 1140671 as not defined bug report (Bugzilla). The advisory is available at bugzilla.suse.com. This vulnerability is traded as CVE-2019-13272 since 07/04/2019. Local access is required to approach this attack. A authentication is required for exploitation. Technical details and a public exploit are known. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

A public exploit has been developed by bcoles in C. The exploit is shared for download at github.com. It is declared as attacked. This issue was added on 12/10/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 06/10/2022:

Apply updates per vendor instructions.

Upgrading to version 5.1.17 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47163). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 5.1.10
• 5.1.11
• 5.1.12
• 5.1.13
• 5.1.14
• 5.1.15
• 5.1.16

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion