CVE-2019-13272
kernel: broken permission and object lifetime handling for PTRACE_TRACEME
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · July 16, 2019
Updated · June 28, 2026
Description
A flaw was found in the way PTRACE_TRACEME functionality was handled in the Linux kernel. The kernel's implementation of ptrace can inadvertently grant elevated permissions to an attacker who can then abuse the relationship between the tracer and the process being traced. This flaw could allow a local, unprivileged user to increase their privileges on the system or cause a denial of service.
Statement
Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4292201
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
For mitigation, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4292201
CVSS / CWE
CVSS 3.0 · 7.8CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-271 · Privilege Dropping / Lowering Errors