{"id":"CVE-2019-20795","title":"iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c","summary":"iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end user…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-416"],"vendor":"iproute2_project","product":"iproute2","affected":["iproute2 < 5.1.0","ubuntu_linux = 18.04"],"patched":["iproute2 5.1.0"],"published":"2020-05-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T08:17:01.427","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-20795","references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1171452","label":"cve@mitre.org"},{"url":"https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202008-06","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4357-1/","label":"cve@mitre.org"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1171452","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202008-06","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4357-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-20795.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-20795"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868211"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20795"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20795"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00403,"epssPercentile":0.3435,"ingestedAt":"2026-10-14T08:23:04.330Z","slug":"CVE-2019-20795","body":"## Overview\n\niproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.\n\n## Affected\n\n- `iproute2 < 5.1.0`\n- `ubuntu_linux = 18.04`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `iproute2 5.1.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-20795.json)","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}