CVE Database›Document archive›CVE-2019-13272

CVE-2019-13272

kernel: broken permission and object lifetime handling for PTRACE_TRACEME

Loading…

Severity

Important

Red Hat Product Security

7.8

CVSS 3.0

Review impact separately from score.

Published · July 16, 2019

Updated · June 28, 2026

Description

A flaw was found in the way PTRACE_TRACEME functionality was handled in the Linux kernel. The kernel's implementation of ptrace can inadvertently grant elevated permissions to an attacker who can then abuse the relationship between the tracer and the process being traced. This flaw could allow a local, unprivileged user to increase their privileges on the system or cause a denial of service.

Statement

Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4292201

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

For mitigation, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/4292201

CVSS / CWE

CVSS 3.0 · 7.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-271 · Privilege Dropping / Lowering Errors