CVE-2019-20795: Use After Free
iproute2 before 5.1.0 has a use-after-free in getnetnsidfromname in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/iproute2to a version that resolves this vulnerability.Fixed in 6.1.0-3Fixed in 6.15.0-1Fixed in 7.2.0-1 - Upgrade
Upgrade
iproute2to a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20795?
The severity of CVE-2019-20795 is considered moderate due to its limited impact primarily in configurations that use setuid.
How do I fix CVE-2019-20795?
To fix CVE-2019-20795, upgrade to iproute2 version 5.1.0 or later.
What versions of iproute2 are affected by CVE-2019-20795?
iproute2 versions prior to 5.1.0 are affected by CVE-2019-20795.
Is there a workaround for CVE-2019-20795?
Disabling setuid usage can serve as a temporary workaround for CVE-2019-20795 until an upgrade is performed.
Can CVE-2019-20795 be exploited remotely?
CVE-2019-20795 typically requires local access and specific configurations, thus remote exploitation is unlikely.