Description
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pulseaudio | 0.9.9-1 | — |
| Debian 13 | pulseaudio | 0.9.9-1 | — |
| Debian 12 | pulseaudio | 0.9.9-1 | — |
| Debian 4.0 | pulseaudio | 0.9.5-5etch1 | DSA-1476-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pulseaudio | 15.0-3.1 | openSUSE-SU-2024:11200-1 |
Advisories 2
- DSA-1476-1 pulseaudio - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11200-1 libpulse-devel-15.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- MDVSA-2008:027 vendor-advisory
- 27449 vdb-entry
- 28623 third-party-advisory
- [pulseaudio-discuss] 20080124 [ANNOUNCE] PulseAudio 0.9.9 mailing-list
- http://pulseaudio.org/changeset/2100
- ADV-2008-0283 vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=207214
- DSA-1476 vendor-advisory
- FEDORA-2008-0963 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=425481
- GLSA-200802-07 vendor-advisory
- FEDORA-2008-0994 vendor-advisory
- 28738 third-party-advisory
- pulseaudio-padroproot-privilege-escalation(39992) vdb-entry
- USN-573-1 vendor-advisory
- 28952 third-party-advisory
- 28608 third-party-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=347822