CVE-2019-20795
Summary
| CVE | CVE-2019-20795 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-05-09 21:15:00 UTC |
|---|
| Updated | 2020-09-10 17:50:00 UTC |
|---|
| Description | iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| USN-4357-1: IPRoute vulnerability | Ubuntu security notices |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| Bug 1171452 – VUL-1: CVE-2019-20795: iproute2: use-after-free in get_netnsid_from_name in ip/ipnetns.c |
MISC |
bugzilla.suse.com |
Issue Tracking, Third Party Advisory |
| iproute2/iproute2.git - Iproute2 routing commands and utilities |
CONFIRM |
git.kernel.org |
Patch, Third Party Advisory |
| iproute2: Denial of service (GLSA 202008-06) — Gentoo security |
GENTOO |
security.gentoo.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500259 Alpine Linux Security Update for iproute2
- 504024 Alpine Linux Security Update for iproute2
- 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
- 671409 EulerOS Security Update for iproute (EulerOS-SA-2022-1327)
- 751239 SUSE Enterprise Linux Security Update for iproute2 (SUSE-SU-2021:3452-1)
