Description
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.19.37-6 | — |
| Debian 13 | linux | 4.19.37-6 | — |
| Debian 12 | linux | 4.19.37-6 | — |
| Debian 10 | linux | 4.19.37-5+deb10u1 | DSA-4484-1 |
| Debian 9 | linux | 4.9.168-1+deb9u4 | DSA-4484-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | linux | 3.16.70-1 | DLA-1862-1 |
| Debian 8 | linux-4.9 | 4.9.168-1+deb9u4~deb8u1 | DLA-1863-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +2 | No fix yet | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-58.64 | USN-4094-1 |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1047.49 | USN-4118-1 |
| Ubuntu 18.04 LTS | linux-azure | 5.0.0-1014.14~18.04.1 | USN-4093-1 |
| Ubuntu 18.04 LTS | linux-gcp +1 | 4.15.0-1040.42 | USN-4094-1 |
| Ubuntu 18.04 LTS | linux-hwe | 5.0.0-25.26~18.04.1 | USN-4093-1 |
| Ubuntu 18.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1042.42 | USN-4094-1 |
| Ubuntu 18.04 LTS | linux-oem | 4.15.0-1050.57 | USN-4094-1 |
| Ubuntu 18.04 LTS | linux-oem-osp1 | 5.0.0-1018.20 | — |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1021.23 | USN-4094-1 |
| Ubuntu 18.04 LTS | linux-raspi2 | 4.15.0-1043.46 | USN-4094-1 |
| Ubuntu 18.04 LTS | linux-snapdragon | 4.15.0-1060.66 | USN-4094-1 |
| Ubuntu 16.04 LTS | linux | 4.4.0-159.187 | USN-4095-1 |
| Ubuntu 16.04 LTS | linux-aws | 4.4.0-1090.101 | USN-4095-1 |
| Ubuntu 16.04 LTS | linux-aws-hwe | 4.15.0-1047.49~16.04.1 | USN-4118-1 |
| Ubuntu 16.04 LTS | linux-azure | 4.15.0-1055.60 | USN-4094-1 |
| Ubuntu 16.04 LTS | linux-gcp | 4.15.0-1040.42~16.04.1 | USN-4094-1 |
| Ubuntu 16.04 LTS | linux-hwe | 4.15.0-58.64~16.04.1 | USN-4094-1 |
| Ubuntu 16.04 LTS | linux-kvm | 4.4.0-1054.61 | USN-4095-1 |
| Ubuntu 16.04 LTS | linux-oracle | 4.15.0-1021.23~16.04.1 | USN-4094-1 |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1118.127 | USN-4095-1 |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1122.128 | USN-4095-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS 18.04 LTS | linux-aws-fips +2 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2018.18 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2006.7 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | 4.4.0-1017.22 | — |
| Ubuntu Pro 14.04 LTS | linux-aws | 4.4.0-1054.58 | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1059.64~14.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux-lts-xenial | 4.4.0-164.192~14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | kernel-rt +12 | 4.18.0-80.7.2.rt9.154.el8_0 | RHSA-2019:2405 |
| RHEL 8 | perf +26 | 4.18.0-80.7.2.el8_0 | RHSA-2019:2411 |
| RHEL 7 | perf +14 | 4.14.0-115.12.1.el7a | RHSA-2019:2809 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | kernel-syms +2 | 4.4.180-94.107.1 | SUSE-SU-2019:2949-1 |
| SLES 12 SP3 | kgraft-patch-SLE12-SP3_Update_23 | 7-2.5 | SUSE-SU-2019:3258-1 |
| SLES 12 SP3 | kgraft-patch-SLE12-SP3_Update_24 +1 | 6-2.5 | SUSE-SU-2019:3258-1 |
| SLES 12 SP3 | kgraft-patch-SLE12-SP3_Update_26 | 6-2.1 | SUSE-SU-2019:3228-1 |
| SLES 12 SP3 | kgraft-patch-SLE12-SP3_Update_27 +1 | 4-2.1 | SUSE-SU-2019:3230-1, SUSE-SU-2019:3228-1 |
| SLES 12 SP3 | kgraft-patch-SLE12-SP3_Update_29 | 1-4.3.1 | SUSE-SU-2019:2949-1 |
| SLES 12 SP2 | kernel-syms +2 | 4.4.121-92.125.1 | SUSE-SU-2019:2984-1 |
| SLES 12 SP2 | kgraft-patch-SLE12-SP2_Update_27 +2 | 7-2.5 | SUSE-SU-2019:3260-1, SUSE-SU-2019:3232-1 |
| SLES 12 SP2 | kgraft-patch-SLE12-SP2_Update_30 | 6-2.1 | SUSE-SU-2019:3261-1 |
| SLES 12 SP2 | kgraft-patch-SLE12-SP2_Update_31 | 5-2.1 | SUSE-SU-2019:3261-1 |
| SLES 12 SP2 | kgraft-patch-SLE12-SP2_Update_32 | 4-2.1 | SUSE-SU-2019:3263-1 |
| SLES 12 SP2 | kgraft-patch-SLE12-SP2_Update_33 | 1-3.5.1 | SUSE-SU-2019:2984-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | kernel-syms +2 | 4.4.180-94.107.1 | SUSE-SU-2019:2949-1 |
| SLES for SAP 12 SP3 | kgraft-patch-SLE12-SP3_Update_23 | 7-2.5 | SUSE-SU-2019:3258-1 |
| SLES for SAP 12 SP3 | kgraft-patch-SLE12-SP3_Update_24 +1 | 6-2.5 | SUSE-SU-2019:3258-1 |
| SLES for SAP 12 SP3 | kgraft-patch-SLE12-SP3_Update_26 | 6-2.1 | SUSE-SU-2019:3228-1 |
| SLES for SAP 12 SP3 | kgraft-patch-SLE12-SP3_Update_27 +1 | 4-2.1 | SUSE-SU-2019:3230-1, SUSE-SU-2019:3228-1 |
| SLES for SAP 12 SP3 | kgraft-patch-SLE12-SP3_Update_29 | 1-4.3.1 | SUSE-SU-2019:2949-1 |
| SLES for SAP 12 SP2 | kernel-syms +2 | 4.4.121-92.125.1 | SUSE-SU-2019:2984-1 |
| SLES for SAP 12 SP2 | kgraft-patch-SLE12-SP2_Update_27 +2 | 7-2.5 | SUSE-SU-2019:3260-1, SUSE-SU-2019:3232-1 |
| SLES for SAP 12 SP2 | kgraft-patch-SLE12-SP2_Update_30 | 6-2.1 | SUSE-SU-2019:3261-1 |
| SLES for SAP 12 SP2 | kgraft-patch-SLE12-SP2_Update_31 | 5-2.1 | SUSE-SU-2019:3261-1 |
| SLES for SAP 12 SP2 | kgraft-patch-SLE12-SP2_Update_32 | 4-2.1 | SUSE-SU-2019:3263-1 |
| SLES for SAP 12 SP2 | kgraft-patch-SLE12-SP2_Update_33 | 1-3.5.1 | SUSE-SU-2019:2984-1 |
| SLE Live Patching 15 SP1 | kernel-livepatch-SLE15-SP1_Update_0 | 8-22.2 | SUSE-SU-2019:3248-1 |
| SLE Live Patching 15 SP1 | kernel-livepatch-SLE15-SP1_Update_1 | 7-2.1 | SUSE-SU-2019:3249-1 |
| SLE Live Patching 15 SP1 | kernel-livepatch-SLE15-SP1_Update_2 | 6-2.1 | SUSE-SU-2019:3230-1 |
| SLE Live Patching 15 | kernel-livepatch-SLE15_Update_11 | 5-2.1 | SUSE-SU-2019:3249-1 |
| SLE Live Patching 15 | kernel-livepatch-SLE15_Update_8 | 7-2.3 | SUSE-SU-2019:3246-1 |
| SLE Live Patching 15 | kernel-livepatch-SLE15_Update_9 +1 | 6-2.3 | SUSE-SU-2019:3248-1, SUSE-SU-2019:3247-1 |
| SLE Live Patching 12 SP4 | kgraft-patch-SLE12-SP4_Update_0 | 9-2.25.1 | SUSE-SU-2019:3252-1 |
| SLE Live Patching 12 SP4 | kgraft-patch-SLE12-SP4_Update_1 | 8-2.5 | SUSE-SU-2019:3252-1 |
| SLE Live Patching 12 SP4 | kgraft-patch-SLE12-SP4_Update_2 | 7-2.5 | SUSE-SU-2019:3223-1 |
| SLE Live Patching 12 SP4 | kgraft-patch-SLE12-SP4_Update_3 +1 | 6-2.5 | SUSE-SU-2019:3225-1, SUSE-SU-2019:3224-1 |
| SLE Live Patching 12 SP4 | kgraft-patch-SLE12-SP4_Update_5 | 5-2.1 | SUSE-SU-2019:3230-1 |
| SLE Live Patching 12 SP4 | kgraft-patch-SLE12-SP4_Update_6 | 4-2.1 | SUSE-SU-2019:3249-1 |
| SUSE OpenStack Cloud Crowbar 8 | kernel-syms +2 | 4.4.180-94.107.1 | SUSE-SU-2019:2949-1 |
| SUSE OpenStack Cloud Crowbar 8 | kgraft-patch-SLE12-SP3_Update_29 | 1-4.3.1 | SUSE-SU-2019:2949-1 |
| SUSE OpenStack Cloud 8 | kernel-syms +2 | 4.4.180-94.107.1 | SUSE-SU-2019:2949-1 |
| SUSE OpenStack Cloud 8 | kgraft-patch-SLE12-SP3_Update_29 | 1-4.3.1 | SUSE-SU-2019:2949-1 |
| SUSE OpenStack Cloud 7 | kernel-syms +2 | 4.4.121-92.125.1 | SUSE-SU-2019:2984-1 |
| SUSE OpenStack Cloud 7 | kgraft-patch-SLE12-SP2_Update_33 | 1-3.5.1 | SUSE-SU-2019:2984-1 |
| SUSE HPE Helion OpenStack 8 | kernel-syms +2 | 4.4.180-94.107.1 | SUSE-SU-2019:2949-1 |
| SUSE HPE Helion OpenStack 8 | kgraft-patch-SLE12-SP3_Update_29 | 1-4.3.1 | SUSE-SU-2019:2949-1 |
| SUSE Enterprise Storage 5 | kernel-syms +2 | 4.4.180-94.107.1 | SUSE-SU-2019:2949-1 |
| SUSE Enterprise Storage 5 | kgraft-patch-SLE12-SP3_Update_29 | 1-4.3.1 | SUSE-SU-2019:2949-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | perf +8 | 4.14.133-113.105.amzn2 | ALAS2-2019-1232 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | perf +19 | 4.18.0-80.7.2.el8_0 | ELSA-2019-2411 |
| Oracle Linux 7 | perf +10 | 4.14.35-1902.4.8.el7uek | ELSA-2019-4746 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Linux Polkit pkexec helper PTRACE_TRACEME local root exploit
exploit/linux/local/ptrace_traceme_pkexec_helper
Exploit-DB 4
- Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2) EDB-50541 · local · Nov 23, 2021
- Linux Polkit - pkexec helper PTRACE_TRACEME local root (Metasploit) EDB-47543 · local · Oct 24, 2019 · verified
- Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation EDB-47163 · local · Jul 24, 2019
- Linux - Broken Permission and Object Lifetime Handling for PTRACE_TRACEME EDB-47133 · local · Jul 17, 2019 · verified
GitHub 19 repositories · most starred shown
-
jas502n/CVE-2019-13272 ★ 333 · Jul 31, 2019
Linux 4.10 < 5.1.17 PTRACE_TRACEME local root
-
Cyc1eC/CVE-2019-13272 ★ 5 · Jul 31, 2019
The exploit for CVE-2019-13272
-
oneoy/CVE-2019-13272 ★ 4 · Aug 7, 2019
linux 提权
-
josemlwdf/CVE-2019-13272 ★ 3 · Jun 20, 2024
This is a Python 3 version of this exploit. Hope it works!!!
-
Tharana/vulnerability-exploitation ★ 3 · May 12, 2020
Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287/Google Android - 'Stagefright' Remote Code Execution - CVE-2015-1538
-
MDS1GNAL/ptrace_scope-CVE-2019-13272-privilege-escalation ★ 2 · Jan 31, 2024
Es una vulnerabilidad para escalar privilegios en linux.
-
Tharana/Exploiting-a-Linux-kernel-vulnerability ★ 1 · May 11, 2020
Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287
-
bigbigliang-malwarebenchmark/cve-2019-13272 ★ 1 · Aug 4, 2019
提权漏洞
-
polosec/CVE-2019-13272 ★ 0 · Mar 5, 2020
CVE-2019-13272
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 30
- USN-4094-1 linux, linux-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Sep 7, 2026
- USN-4093-1 linux, linux-hwe, linux-azure, linux-gcp, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Sep 7, 2026
- USN-4118-1 linux-aws vulnerabilities Ubuntu Security Notices (USN) · Sep 7, 2026
- USN-4095-1 linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Sep 7, 2026
- RHSA-2019:2809 Red Hat Security Advisory: kernel-alt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2405 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2411 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4484-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1863-1 linux-4.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1862-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:3230-1 Security update for the Linux Kernel (Live Patch 28 for SLE 12 SP3) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3232-1 Security update for the Linux Kernel (Live Patch 27 for SLE 12 SP2) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3252-1 Security update for the Linux Kernel (Live Patch 1 for SLE 12 SP4) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3260-1 Security update for the Linux Kernel (Live Patch 29 for SLE 12 SP2) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2949-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3225-1 Security update for the Linux Kernel (Live Patch 4 for SLE 12 SP4) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3224-1 Security update for the Linux Kernel (Live Patch 3 for SLE 12 SP4) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3247-1 Security update for the Linux Kernel (Live Patch 9 for SLE 15) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3263-1 Security update for the Linux Kernel (Live Patch 32 for SLE 12 SP2) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3228-1 Security update for the Linux Kernel (Live Patch 27 for SLE 12 SP3) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2984-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3261-1 Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP2) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3246-1 Security update for the Linux Kernel (Live Patch 8 for SLE 15) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3248-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP1) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3258-1 Security update for the Linux Kernel (Live Patch 25 for SLE 12 SP3) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3223-1 Security update for the Linux Kernel (Live Patch 2 for SLE 12 SP4) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:3249-1 Security update for the Linux Kernel (Live Patch 1 for SLE 15 SP1) SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2019-1232 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 15, 2022
- ELSA-2019-2411 Important: kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 19, 2019
- ELSA-2019-4746 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 15, 2019
References
- http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.html
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17
- https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41ee
- https://bugzilla.suse.com/show_bug.cgi?id=1140671
- https://bugzilla.redhat.com/show_bug.cgi?id=1730895
- FEDORA-2019-a95015e60f vendor-advisory
- DSA-4484 vendor-advisory
- 20190722 [SECURITY] [DSA 4484-1] linux security update mailing-list
- 20190722 [slackware-security] Slackware 14.2 kernel (SSA:2019-202-01) mailing-list
- [debian-lts-announce] 20190723 [SECURITY] [DLA 1862-1] linux security update mailing-list
- [debian-lts-announce] 20190723 [SECURITY] [DLA 1863-1] linux-4.9 security update mailing-list
- http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- https://security.netapp.com/advisory/ntap-20190806-0001/
- RHSA-2019:2405 vendor-advisory
- RHSA-2019:2411 vendor-advisory
- USN-4093-1 vendor-advisory
- USN-4094-1 vendor-advisory
- USN-4095-1 vendor-advisory
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
- https://support.f5.com/csp/article/K91025336
- USN-4117-1 vendor-advisory
- USN-4118-1 vendor-advisory
- RHSA-2019:2809 vendor-advisory
- https://support.f5.com/csp/article/K91025336?utm_source=f5support&%3Butm_medium=RSS
- http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.html
- http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html
- http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.html