Summary
PulseAudio in Ubuntu contains additional functionality to mediate audio
recording for snap packages and it was discovered that this functionality
did not mediate PulseAudio module unloading. An attacker-controlled snap
with only the audio-playback interface connected could exploit this to
bypass access controls and record audio.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | pulseaudio | 1:8.0-0ubuntu3.12 |
| Ubuntu · 18.04 LTS 18.04:LTS | pulseaudio | 1:11.1-1ubuntu7.7 |
| Ubuntu · 20.04 LTS 20.04:LTS | pulseaudio | 1:13.99.1-1ubuntu3.2 |
Vulnerabilities 1
-
Low 3.3
Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the puls…