CVE-2019-20795
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c.
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
- Record
CVE-2019-20795- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
- Record
CVE-2019-20795- Updated
- 2026-11-02
EUVDEUVD-2019-11332 No score
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
- Record
EUVD-2019-11332- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7x5p-w7r4-hq6m
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c.
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c.
- Record
GHSA-7x5p-w7r4-hq6m- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-20795
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
- Record
ALPINE-CVE-2019-20795- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2019-20795
CVE-2019-20795 does not affect BellSoft software
- Record
BELL-CVE-2019-20795- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSV
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
- Record
CVE-2019-20795- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-20795
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
- Record
DEBIAN-CVE-2019-20795- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-20795
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
- Record
UBUNTU-CVE-2019-20795- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2021:3452-1 No score
Security update for iproute2
This update for iproute2 fixes the following issues:
- CVE-2019-20795: Fixed a use-after-free vulnerability in get_netnsid_from_name. (bsc#1171452)
- Record
SUSE-SU-2021:3452-1- Updated
- 2026-11-02
OSVUSN-4357-1 No score
iproute2 vulnerability
It was discovered that IPRoute incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.
- Record
USN-4357-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iproute2Alpine:v3.10 |
before 4.20.0-r2 | 4.20.0-r2 |
iproute2Alpine:v3.11 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.12 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.13 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.14 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.15 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.16 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.17 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.18 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.19 |
before 5.1.0-r0 | 5.1.0-r0 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
iproute2Alpine:v3.20 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.21 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.22 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.23 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.24 |
before 5.1.0-r0 | 5.1.0-r0 |
iproute2Alpine:v3.9 |
before 4.19.0-r1 | 4.19.0-r1 |
iproute2Debian:12 |
before 5.2.0-1 | 5.2.0-1 |
iproute2Debian:13 |
before 5.2.0-1 | 5.2.0-1 |
iproute2Debian:14 |
before 5.2.0-1 | 5.2.0-1 |
iproute2SUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 4.12-16.6.1 | 4.12-16.6.1 |
iproute2SUSE:Linux Enterprise Server 12 SP5 |
before 4.12-16.6.1 | 4.12-16.6.1 |
iproute2SUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 4.12-16.6.1 | 4.12-16.6.1 |
iproute2Ubuntu:18.04:LTS |
before 4.15.0-2ubuntu1.1, plus listed versions 4.9.0-1ubuntu24.9.0-1ubuntu34.14.1-0ubuntu24.14.1-0ubuntu34.15.0-2ubuntu1 |
4.15.0-2ubuntu1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-20795 is a medium vulnerability (CVSS 4.4) in Iproute2 Project Iproute2, published May 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in iproute2 4.20.0-r2.
References
git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10
bugzilla.suse.com/show_bug.cgi?id=1171452
usn.ubuntu.com/4357-1
security.gentoo.org/glsa/202008-06
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2019-20795
Show 11 moreShow less
github.com/advisories/GHSA-7x5p-w7r4-hq6m
security.alpinelinux.org/vuln/CVE-2019-20795
docs.bell-sw.com/security/cves/CVE-2019-20795
security-tracker.debian.org/tracker/CVE-2019-20795
suse.com/support/update/announcement/2021/suse-su-20213452-1
ubuntu.com/security/CVE-2019-20795
cve.org/CVERecord?id=CVE-2019-20795