CVE-2019-20795
Published: August 31, 2023Last modified: August 31, 2023
Description
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
Severity score breakdown
Parameter | Value |
---|---|
Base score | 4.4 |
Attack Vector | LOCAL |
Attack complexity | LOW |
Privileges required | HIGH |
User interaction | NONE |
Scope | UNCHANGED |
Confidentiality | NONE |
Integrity impact | NONE |
Availability impact | HIGH |
Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Status
Product | Release | Package | Status |
---|---|---|---|
Alpaquita Linux | 23 LTS | iproute2 | Not affected (6.0.0-r1) |
Stream | iproute2 | Not affected (6.4.0-r0) |