CVE-2008-0008

Published: 29 January 2008

The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.

Priority

Low

Notes

AuthorNote
jdstrand
not possible to exploit in default installation. In fact, need an
LSM to fail the call and then not protect the binary properly, so this is
almost a non-issue on Ubuntu
patched prepared

References

Bugs