CVE-2022-4964 - OpenCVE

Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Canonical	Ubuntu Pipewire-pulse

Configuration 1 [-]

cpe:2.3:a:canonical:ubuntu_pipewire-pulse:-:*:*:*:*:*:*:*

References

Link	Resource
https://bugs.launchpad.net/ubuntu/+source/pipewire/+bug/1995707/	Exploit Issue Tracking
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4964	Third Party Advisory
https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1779	Issue Tracking Patch
https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567	Issue Tracking Patch

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: canonical

Published: 2024-01-24T00:58:14.236Z

Updated: 2024-01-24T00:58:14.236Z

Reserved: 2024-01-23T23:08:14.851Z

Link: CVE-2022-4964

JSON object: View

NVD Information

Status : Analyzed

Published: 2024-01-24T01:15:07.977

Modified: 2024-01-30T21:50:30.930

Link: CVE-2022-4964

JSON object: View

Redhat Information

No data.

CWE

CWE-276

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:ubuntu_pipewire-pulse:-:*:*:*:*:*:*:*", "matchCriteriaId": "C3BB6606-35AC-43FF-8CB1-9BEFC47731E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set."}, {"lang": "es", "value": "Pipewire-pulse en snap de Ubuntu otorga acceso al micr\u00f3fono incluso cuando la interfaz snap para grabaci\u00f3n de audio no est\u00e1 configurada."}], "id": "CVE-2022-4964", "lastModified": "2024-01-30T21:50:30.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2024-01-24T01:15:07.977", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://bugs.launchpad.net/ubuntu/+source/pipewire/+bug/1995707/"}, {"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4964"}, {"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Patch"], "url": "https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1779"}, {"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Patch"], "url": "https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}]}