Local Privilege Escalation in Linux Kernel via CVE-2019-13272

CVE-2019-13272 is a local privilege escalation vulnerability affecting Linux kernel versions prior to 5.1.17. The flaw resides in the ptrace_link function within kernel/ptrace.c, where the kernel mishandles the recording of credentials during the establishment of a ptrace relationship. An unprivileged local user can exploit this behavior by creating a specific parent-child process relationship where the parent drops privileges and calls execve, allowing an attacker to exert control. The exploit leverages privileged tracing through mechanisms such as the PTRACE_TRACEME request, often targeting setuid binaries like pkexec to obtain root-level execution. The recent publication of functional proof-of-concept code on Sploitus has significantly increased the risk of exploitation for legacy and unpatched systems.

Attack Chain

1. The attacker gains initial access to the target system as a low-privileged user.
2. The attacker identifies or executes a vulnerable target binary (e.g., /usr/bin/pkexec or similar suid-privileged helpers).
3. The attacker initiates a ptrace relationship using the PTRACE_TRACEME request targeting the chosen helper.
4. The parent process drops privileges while keeping the ptrace relationship active.
5. The parent process calls execve, triggering the ptrace_link credential mishandling in the kernel.
6. The kernel incorrectly records the credentials, allowing the child process to retain or gain elevated root privileges.
7. The attacker interacts with the now-privileged process to spawn a root shell.

Impact

Successful exploitation of CVE-2019-13272 results in full local privilege escalation, granting an attacker complete control over the affected system. This vulnerability is highly dangerous in multi-user environments, shared hosting, or containers where local users could compromise the host or other tenants.

Recommendation

Prioritize patching Linux kernels to version 5.1.17 or later on all exposed systems. In environments where immediate kernel updates are not feasible, consider implementing the SELinux 'deny_ptrace' policy to restrict the ability of processes to trace one another, which can mitigate the exploitation vector of this vulnerability.