CVE-2019-13272

What is ptrace?

ptrace is the Linux kernel's process-tracing facility, used by debuggers (like gdb), sandboxing tools, and system-call interception frameworks to observe and control another process's execution. It grants the tracer significant visibility and control over the traced process, so the kernel must be extremely careful about exactly what capabilities a tracing relationship confers — and to whom — especially when privileges change mid-trace.

Overview

CVE-2019-13272 is a privilege escalation vulnerability in kernel/ptrace.c caused by improper credential handling when a process is being traced by another, unprivileged process at the moment it changes its own privilege level (for example, by executing a setuid/setgid binary). By carefully orchestrating this sequence, a local unprivileged attacker can gain the ability to access a portion of the higher-privileged process's memory or capabilities, ultimately allowing escalation to root.

Technical Details

The flaw (CWE-269, improper privilege management) arises from a race condition: when an unprivileged process is granted a PTRACE_TRACEME-style tracing relationship over another process, and that traced process subsequently executes a binary that would normally grant it elevated privileges (a setuid root binary, for instance), the kernel's credential-transfer logic fails to correctly revoke the existing ptrace access rights that were granted under the process's prior, lower-privileged state. This allows the still-attached unprivileged tracer to retain a level of control or access appropriate only to the pre-privilege-change context, over a process that now holds elevated capabilities — effectively letting the attacker's own credentials ride along with the privilege escalation the traced process undergoes. The attack requires only local code execution and no special privileges to start, since setting up a ptrace relationship over a child process is an ordinary unprivileged operation.

Discovery

The vulnerability was discovered and reported to the Linux kernel security team by Jann Horn of Google Project Zero, a researcher well known for identifying numerous credential-handling and race-condition bugs across kernel ptrace and namespace code over the years.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has been exploited in real-world attacks against unpatched Linux systems. As a local root-privilege-escalation primitive, it is most commonly used as a post-compromise step — after an attacker gains initial low-privileged code execution on a Linux host via a web application vulnerability, exposed service, or stolen credentials — to escalate to root and gain full control of the system.

Remediation

1. Update to a Linux kernel version that includes the fix: mainline 5.3 or later, or the backported stable releases 5.1.17, 4.19.63, 4.14.137, and equivalent vendor-distributed kernel updates.
2. Apply distribution-specific kernel security patches promptly, since most major distributions (Red Hat, Debian, Ubuntu, SUSE) backported this fix shortly after disclosure.
3. Restrict which users and processes are permitted to use ptrace where feasible, using mechanisms like the Yama LSM's ptrace_scope sysctl to limit unprivileged process tracing.
4. Treat unpatched Linux kernels as a standing local-privilege-escalation risk even on systems without direct external exposure, since exploitation requires only local code execution.
5. Audit systems for unexpected root-level process activity correlated with ptrace/debugging tool usage on hosts that remained unpatched.