CVE-2019-13272

CVE-2019-13272 is an improper privilege management flaw in the Linux kernel's ptrace_link function (kernel/ptrace.c), present in kernels before 5.1.17, in which the credentials of a process requesting a ptrace relationship are mishandled. A local attacker triggers it by stepping into a parent-child process chain where a privileged parent drops privileges and calls execve, typically by abusing Polkit's pkexec helper with PTRACE_TRACEME; contributing factors include an object lifetime issue and incorrect marking of the ptrace relationship as privileged. Successful exploitation grants the attacker full root-level privileges on the host, and the object lifetime bug can in some cases cause a system panic. Any Linux system running an unpatched kernel is affected, spanning the upstream kernel and distributions such as Debian, Fedora, Ubuntu, Red Hat Enterprise Linux and its variants, as well as NetApp AFF A700s firmware. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-12-10), has multiple public proof-of-concept exploits, and carries a high exploitation probability (EPSS ~52%), so defenders should treat it as an active exploitation risk.

What to do: Upgrade the Linux kernel to 5.1.17 or later, or install the backported kernel update from your distribution (Debian, Ubuntu, Fedora, Red Hat) and NetApp's fixed firmware for AFF A700s, per CISA's required action to apply vendor updates. Where patching is delayed, SELinux with deny_ptrace may serve as a usable mitigation in some environments. Prioritize hosts that expose local shells to untrusted users and that have Polkit's pkexec installed, and verify the running kernel version (not just the installed package) on each system.