PT-2020-10766 · Linux+4 · Iproute2+4

Published 2019-05-15 · Updated 2021-10-18 · CVE-2019-20795

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iproute2 versions prior to 5.1.0

Description The issue is related to a use-after-free in the get netnsid from name function in ip/ipnetns.c. This may have limited security relevance, particularly in certain configurations where setuid is used, although other factors such as C library configuration may affect exploitability.

Recommendations For versions prior to 5.1.0, update to version 5.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of setuid configurations to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2019-1829

CVE-2019-20795

SUSE-SU-2021:3452-1

SUSE-SU-2021_3452-1

USN-4357-1

Affected Products

Alt Linux

Astra Linux

Suse

Ubuntu

Iproute2

References · 21

• https://security-tracker.debian.org/tracker/CVE-2019-20795 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3452-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4357-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20795 · Security Note
• https://security.gentoo.org/glsa/202008-06 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20795 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-20795 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20795 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20795 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20795 · Vendor Advisory
• https://usn.ubuntu.com/4357-1 · Vendor Advisory
• https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10 · Patch
• https://osv.dev/vulnerability/USN-4357-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-20795 · Vendor Advisory
• https://t.me/cvenotify/3697 · Telegram Post