Cloudanix VulnDB

CVE-2020-11931

Low · 3.3

CVSS

3.3

EPSS

0.3%

Published

May 15, 2020

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Ubuntu's audio handling lets certain packaged apps reach sound features they are supposed to be blocked from, and updating the audio software fixes it.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A local snap application granted pulseaudio, audio-playback, or audio-record interfaces can unload the pulseaudio snap policy module, bypassing the intended Ubuntu security mediation and gaining unauthorized access to audio resources.

Why it matters to the business

Limited local exposure of audio streams or device access on Ubuntu systems running older pulseaudio packages; low operational risk given the local attack vector and modest CVSS score, but still requires patching to maintain snap confinement guarantees.

How an attack unfolds

An attacker packages a snap that declares one of the audio plugs, installs it on a vulnerable Ubuntu system, and issues the module-unload command to disable the mediating policy, allowing the snap to reach audio resources outside its intended confinement.

How to fix it

Upgrade pulseaudio to 1:8.0-0ubuntu3.12 or newer, 1:11.1-1ubuntu7.7 or newer, 1:13.0-1ubuntu1.2 or newer, or 1:13.99.1-1ubuntu3.2 or newer depending on the Ubuntu release in use.

How to confirm the fix worked

Verify installed pulseaudio package version matches or exceeds the fixed releases listed for the running Ubuntu release; confirm the pulseaudio snap policy module remains loaded after snap installation.

Typical attack path

  1. Craft or obtain a snap package that requests pulseaudio, audio-playback, or audio-record interfaces
  2. Install the snap on a vulnerable Ubuntu release
  3. Trigger unloading of the pulseaudio snap policy module
  4. Access audio resources that should have been restricted

How to detect it

Review system logs for pulseaudio module unload events triggered by snap processes and inspect snap declarations for audio interfaces on systems that have not yet been updated.

  • pulseaudio.*unload.*module
  • snap.*pulseaudio.*policy

What your security team should do

  • Apply the appropriate pulseaudio package update immediately on all Ubuntu systems
  • Audit installed snaps for unnecessary audio interfaces
  • Monitor for future pulseaudio updates in Ubuntu security notices

The record

An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS pulseaudio 0 1:8.0-0ubuntu3.12
Ubuntu:18.04:LTS pulseaudio 0 1:11.1-1ubuntu7.7
Ubuntu:20.04:LTS pulseaudio 0 1:13.99.1-1ubuntu3.2

Related vulnerabilities