Description
alsa-utils 1.0.19 and later versions allows local users to overwrite arbitrary files via a symlink attack via the /usr/bin/alsa-info and /usr/bin/alsa-info.sh scripts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| alsa-driver | alsa-driver | 1.0.19 and later | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | alsa | 1.1.2-2.1 | openSUSE-SU-2024:10544-1 |
Advisories 1
- openSUSE-SU-2024:10544-1 alsa-1.1.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026