CVE-2020-16123 - OpenCVE

An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:L/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Canonical	Ubuntu Linux

Configuration 1 [-]

OR	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:20.10:::::::*

References

Link	Resource
https://launchpad.net/bugs/1895928	Exploit Issue Tracking Third Party Advisory
https://ubuntu.com/USN-4640-1	Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: canonical

Published: 2020-11-23T00:00:00

Updated: 2020-12-03T23:15:20

Reserved: 2020-07-29T00:00:00

Link: CVE-2020-16123

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-12-04T00:15:11.880

Modified: 2020-12-10T14:52:17.947

Link: CVE-2020-16123

JSON object: View

Redhat Information

No data.

CWE

CWE-362

{"containers": {"cna": {"affected": [{"product": "pulseaudio", "vendor": "Canonical", "versions": [{"lessThan": "1:13.99.3-1ubuntu2", "status": "affected", "version": "1:13.99.3-1", "versionType": "custom"}, {"lessThan": "1:13.99.2-1ubuntu2.1", "status": "affected", "version": "1:13.99.2-1", "versionType": "custom"}, {"lessThan": "1:13.99.1-1ubuntu3.8", "status": "affected", "version": "1:13.99.1-1", "versionType": "custom"}, {"lessThan": "1:11.1-1ubuntu7.11", "status": "affected", "version": "1:11.1-1", "versionType": "custom"}, {"lessThan": "1:8.0-0ubuntu3.15", "status": "affected", "version": "1:8.0-0", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "James Henstridge"}], "datePublic": "2020-11-23T00:00:00", "descriptions": [{"lang": "en", "value": "An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-12-03T23:15:20", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://launchpad.net/bugs/1895928"}, {"tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://ubuntu.com/USN-4640-1"}], "source": {"advisory": "https://ubuntu.com/USN-4640-1", "defect": ["https://launchpad.net/bugs/1895928"], "discovery": "INTERNAL"}, "title": "Bypass of snapd pulseaudio restrictions", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "", "ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2020-11-23T15:43:00.000Z", "ID": "CVE-2020-16123", "STATE": "PUBLIC", "TITLE": "Bypass of snapd pulseaudio restrictions"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "pulseaudio", "version": {"version_data": [{"platform": "", "version_affected": "<", "version_name": "1:13.99.3-1", "version_value": "1:13.99.3-1ubuntu2"}, {"platform": "", "version_affected": "<", "version_name": "1:13.99.2-1", "version_value": "1:13.99.2-1ubuntu2.1"}, {"platform": "", "version_affected": "<", "version_name": "1:13.99.1-1", "version_value": "1:13.99.1-1ubuntu3.8"}, {"platform": "", "version_affected": "<", "version_name": "1:11.1-1", "version_value": "1:11.1-1ubuntu7.11"}, {"platform": "", "version_affected": "<", "version_name": "1:8.0-0", "version_value": "1:8.0-0ubuntu3.15"}]}}]}, "vendor_name": "Canonical"}]}}, "configuration": [], "credit": [{"lang": "eng", "value": "James Henstridge"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15."}]}, "exploit": [], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)"}]}]}, "references": {"reference_data": [{"name": "https://launchpad.net/bugs/1895928", "refsource": "UBUNTU", "url": "https://launchpad.net/bugs/1895928"}, {"name": "https://ubuntu.com/USN-4640-1", "refsource": "UBUNTU", "url": "https://ubuntu.com/USN-4640-1"}]}, "solution": [], "source": {"advisory": "https://ubuntu.com/USN-4640-1", "defect": ["https://launchpad.net/bugs/1895928"], "discovery": "INTERNAL"}, "work_around": []}}}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2020-16123", "datePublished": "2020-11-23T00:00:00", "dateReserved": "2020-07-29T00:00:00", "dateUpdated": "2020-12-03T23:15:20", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*", "matchCriteriaId": "338B3AAC-C147-4A31-95E7-6E8A6FB4B3FC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15."}, {"lang": "es", "value": "Un parche espec\u00edfico de Ubuntu en PulseAudio cre\u00f3 una condici\u00f3n de carrera en la que el m\u00f3dulo de pol\u00edtica instant\u00e1nea presentar\u00eda un fallo al identificar una conexi\u00f3n de cliente desde un complemento como proveniente de un complemento si faltaba SCM_CREDENTIALS, lo que permite que el complemento se conecte a PulseAudio sin el confinamiento adecuado. Un atacante podr\u00eda explotar esto para exponer informaci\u00f3n confidencial. Corregido en versiones 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11 y 1:8.0-0ubuntu3.15"}], "id": "CVE-2020-16123", "lastModified": "2020-12-10T14:52:17.947", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2020-12-04T00:15:11.880", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://launchpad.net/bugs/1895928"}, {"source": "security@ubuntu.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://ubuntu.com/USN-4640-1"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "security@ubuntu.com", "type": "Secondary"}]}