CVE-2019-13272

A flaw in Linux kernel's ptrace system allows a local attacker to gain root privileges by exploiting how the system records process credentials when creating a process tracing relationship. This can happen when a parent process drops privileges and runs a new program, potentially giving an attacker control.

CVE-2019-13272 involves a credential recording vulnerability in kernel/ptrace.c's ptrace_link function that fails to properly handle privileged ptrace relationships. The attack exploits parent-child process scenarios where privilege dropping precedes execve(), combined with object lifetime issues and incorrect privilege marking of ptrace relationships (exploitable via helpers like Polkit's pkexec with PTRACE_TRACEME), enabling local privilege escalation to root.