The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check…
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
Why it matters now
EPSS 0.00556 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:* | 2007.1 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:x86_64:*:*:*:*:* | 2007.1 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:* | 2008.0 | Running on | Mandrakesoft |
| cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:x86_64:*:*:*:*:* | 2008.0 | Running on | Mandrakesoft |
| cpe:2.3:o:redhat:fedora:7:*:*:*:*:*:*:* | 7 | Running on | Red Hat |
| cpe:2.3:o:redhat:fedora:8:*:*:*:*:*:*:* | 8 | Running on | Red Hat |
| cpe:2.3:a:pulseaudio:pulseaudio:0.9.6:*:*:*:*:*:*:* | 0.9.6 | Vulnerable | Pulseaudio |
| cpe:2.3:a:pulseaudio:pulseaudio:0.9.8:*:*:*:*:*:*:* | 0.9.8 | Vulnerable | Pulseaudio |
- cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:* Versions 2007.1 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:x86_64:*:*:*:*:* Versions 2007.1 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:* Versions 2008.0 Running on ·Mandrakesoft
- cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:x86_64:*:*:*:*:* Versions 2008.0 Running on ·Mandrakesoft
- cpe:2.3:o:redhat:fedora:7:*:*:*:*:*:*:* Versions 7 Running on ·Red Hat
- cpe:2.3:o:redhat:fedora:8:*:*:*:*:*:*:* Versions 8 Running on ·Red Hat
- cpe:2.3:a:pulseaudio:pulseaudio:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·Pulseaudio
- cpe:2.3:a:pulseaudio:pulseaudio:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·Pulseaudio
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-0008
- 2026-10-03 Alias added: GHSA-8542-rfhf-wf9j
References
Exploit 1
Advisory 8
More Pulseaudio vulnerabilities
- TI-2007-01728 PulseAudio 0.9.5 allows remote attackers to cause a denial of service (daemon crash) via… CVSS 2.0HIGH 7.8
- TI-2009-01805 Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain… CVSS 2.0HIGH 7.2
- TI-2009-01234 The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows… CVSS 2.0MEDIUM 6.9
- TI-2024-10735 Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. CVSS 3.1MEDIUM 4.0
- TI-2014-03237 The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio… CVSS 2.0LOW 2.9
- TI-2020-09595 Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded CVSS 3.1LOW 3.3
Sources
- CVE-2008-0008 · CVE Program
- CVE-2008-0008 · NVD
- FIRST EPSS
- GHSA-8542-rfhf-wf9j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences