Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2019-13272In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to…

Description

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Linux Kernel Improper Privilege Management Vulnerability.

Added
10 Dec 2021
Fix due (US federal)
10 Jun 2022
Used by ransomware
Not known

Apply updates per vendor instructions.

ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 10 Dec 2021.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Metasploit module and 4 Exploit-DB entries for it. CISA's SSVC rates its exploitation: it is being exploited.

Show the exploits5

Metasploit modules1 module

Exploit-DB4 entries

Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from

Timeline

  1. ID reserved

    By mitre

  2. · 13 days later

    Published

  3. · 2 years later

    Added to CISA KEV

    Known exploited in the wild

  4. · 4 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2019-13272, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
52.2% · top 1.0% of all CVEs (14 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

  • n/a

    • affected n/a

References

References30

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2019-13272 badge
[![CVE-2019-13272](https://cveledger.app/badge/CVE-2019-13272.svg)](https://cveledger.app/cve/CVE-2019-13272)

Record last updated .