Cloudanix VulnDB

CVE-2020-15710

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Nov 19, 2020

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in audio software used on some Linux computers could let a person already logged into the machine make the sound system stop working when Bluetooth headphones or speakers are connected.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A double free vulnerability in the BlueZ 5 Bluetooth module of PulseAudio allows a local attacker to cause memory corruption, potentially leading to memory leaks or program crashes.

Why it matters to the business

Systems running affected PulseAudio versions may experience audio service crashes when Bluetooth devices are used, disrupting audio functionality for local users on Ubuntu and similar Linux distributions.

How an attack unfolds

A local attacker interacts with the Bluetooth stack to trigger a failure condition in src/modules/bluetooth/module-bluez5-device.c, causing the modargs variable to be freed twice and resulting in memory corruption.

How to fix it

Upgrade PulseAudio to version 1:8.0-0ubuntu3.14 or later on affected Ubuntu systems; apply equivalent fixes from upstream PulseAudio project releases.

How to confirm the fix worked

Confirm PulseAudio package version meets or exceeds the fixed release and test Bluetooth audio operations to ensure no crashes occur under failure conditions.

Typical attack path

  1. Obtain local access to an affected system
  2. Connect or interact with a Bluetooth device to invoke the BlueZ5 module
  3. Trigger the error path that frees modargs twice
  4. Observe resulting memory leak or crash

How to detect it

Inspect system and application logs for PulseAudio crashes or errors referencing module-bluez5-device.c; examine core dumps or crash reports for signs of double-free memory corruption in the Bluetooth module.

What your security team should do

  • Prioritize patching PulseAudio packages across all Ubuntu Linux deployments
  • Review and restrict unnecessary local user access where Bluetooth audio is not required
  • Monitor crash reporting systems for PulseAudio Bluetooth module failures

The record

Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS pulseaudio 0 1:8.0-0ubuntu3.14
Ubuntu:18.04:LTS pulseaudio 0 1:11.1-1ubuntu7

Related vulnerabilities