Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284, CWE-668 and the CVSS impact.
Summary
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | pulseaudio | 1:8.0 to before 1:8.0-0ubuntu3.12; 1:11.1 to before 1:11.1-1ubuntu7.7; 1:13.0 to before 1:13.0-1ubuntu1.2; 1:13.99.1 to before 1:13.99.1-1ubuntu3.2 | 1:8.0-0ubuntu3.12, 1:11.1-1ubuntu7.7, 1:13.0-1ubuntu1.2, 1:13.99.1-1ubuntu3.2 | Patch available | CNA |
- pulseaudio VendorCanonical Affected 1:8.0 to before 1:8.0-0ubuntu3.12; 1:11.1 to before 1:11.1-1ubuntu7.7; 1:13.0 to before 1:13.0-1ubuntu1.2; 1:13.99.1 to before 1:13.99.1-1ubuntu3.2 Fixed in 1:8.0-0ubuntu3.12, 1:11.1-1ubuntu7.7, 1:13.0-1ubuntu1.2, 1:13.99.1-1ubuntu3.2 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pulseaudio:pulseaudio:*:*:*:*:*:*:*:* | up to 1.8.0 | Vulnerable | Pulseaudio |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
- cpe:2.3:a:pulseaudio:pulseaudio:*:*:*:*:*:*:*:* Versions up to 1.8.0 Vulnerable ·Pulseaudio
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
Remediation
- Fix · CNA pulseaudio (Canonical) Fixed in 1:8.0-0ubuntu3.12, 1:11.1-1ubuntu7.7, 1:13.0-1ubuntu1.2, 1:13.99.1-1ubuntu3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11931
- 2026-10-03 Alias added: GHSA-m777-7jfr-8wgh
References
More Canonical Ubuntu Linux vulnerabilities
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-11931 · CVE Program
- CVE-2020-11931 · NVD
- FIRST EPSS
- GHSA-m777-7jfr-8wgh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences