CVE-2019-11190

What it actually does

The flaw permits local users to bypass ASLR on setuid programs because install_exec_creds() is invoked too late in load_elf_binary(), creating a race condition that allows ptrace_may_access() to succeed when reading /proc/pid/stat.

Why it matters to the business

Local attackers can obtain memory layout information for privileged binaries, increasing the likelihood of successful privilege-escalation attacks on affected Linux systems.

How an attack unfolds

An attacker launches a setuid binary such as /bin/su, attaches via ptrace before credentials are installed, and races the read of /proc/pid/stat to leak ASLR offsets for use in follow-on exploits.

How to fix it

Upgrade the Linux kernel to a version containing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 or any release after 4.8 that includes the fix.

How to confirm the fix worked

Verify the running kernel version is 4.8 or newer and confirm the presence of commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 in the kernel source tree.

Typical attack path

1. Identify a setuid binary on the target system
2. Fork and exec the binary while attaching ptrace
3. Race the window before install_exec_creds() completes
4. Read /proc/pid/stat to obtain ASLR information
5. Leverage leaked addresses in a subsequent memory-corruption exploit

How to detect it

Review system logs and audit trails for ptrace attachments to setuid processes and rapid reads of /proc/pid/stat around execve events.

What your security team should do

• Apply the kernel patch or upgrade to a fixed release immediately
• Restrict ptrace access using Yama or seccomp filters where feasible
• Monitor for local exploitation attempts against setuid binaries