CVE-2024-11586

What it actually does

A malicious local program can crash the pulseaudio daemon when a bluetooth headset is connected, resulting in denial of service.

Why it matters to the business

Audio playback and microphone functionality become unavailable on affected Ubuntu systems, interrupting user workflows until the service is restarted.

How an attack unfolds

An attacker with local access runs a specially crafted program while a bluetooth headset is paired, triggering the crash condition in pulseaudio.

How to fix it

Upgrade affected packages to the listed fixed versions: wireshark (Ubuntu:14.04:LTS) to 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 and wireshark (Ubuntu:16.04:LTS) to 2.0.2+ga16e22e-1.

How to confirm the fix worked

Verify package versions match the fixed releases and confirm pulseaudio remains stable under the described bluetooth conditions.

Typical attack path

1. Obtain local execution on target Ubuntu system
2. Ensure bluetooth headset is connected
3. Execute malicious program to trigger pulseaudio crash

How to detect it

Review system logs for unexpected pulseaudio crashes or restarts coinciding with bluetooth device connections; no widespread exploitation indicators exist due to low EPSS and lack of KEV listing.

What your security team should do

• Apply the specified package upgrades immediately on all Ubuntu 14.04 and 16.04 systems
• Monitor for any local privilege abuse that could enable the crash
• Test audio functionality post-update in bluetooth scenarios