CVE-2019-20795

Medium

Description

iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.

SeverityMedium

CVSS4.4

Exploit probability—

ProductIproute2

PublishedMay 9, 2020

First seenMay 9, 2020

How to fix

Update

iproute2_project iproute25.1.0 or later

Vendor advisories

usn.ubuntu.com/4357-1/
security.gentoo.org/glsa/202008-06

Affected products

Product	Affected versions	Fixed in
iproute2_project iproute2	v < 5.1.0	5.1.0
canonical ubuntu_linux	18.04	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.