TI-2020-12682 Aliases CVE-2020-16123 GHSA-h38w-g4mp-rwv7

Bypass of snapd pulseaudio restrictions

LOW 22CWE-362Published 2020-12-03 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.

Why it matters now

EPSS 0.00318 24th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed pulseaudio (Canonical): 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	pulseaudio	1:13.99.3-1 to before 1:13.99.3-1ubuntu2; 1:13.99.2-1 to before 1:13.99.2-1ubuntu2.1; 1:13.99.1-1 to before 1:13.99.1-1ubuntu3.8; 1:11.1-1 to before 1:11.1-1ubuntu7.11; 1:8.0-0 to before 1:8.0-0ubuntu3.15	1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, 1:8.0-0ubuntu3.15	Patch available	CNA

pulseaudio VendorCanonical Affected 1:13.99.3-1 to before 1:13.99.3-1ubuntu2; 1:13.99.2-1 to before 1:13.99.2-1ubuntu2.1; 1:13.99.1-1 to before 1:13.99.1-1ubuntu3.8; 1:11.1-1 to before 1:11.1-1ubuntu7.11; 1:8.0-0 to before 1:8.0-0ubuntu3.15 Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, 1:8.0-0ubuntu3.15 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::	16.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::	18.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::	20.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:20.10:::::::*	20.10	Vulnerable	Canonical

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:* Versions 20.10 Vulnerable ·Canonical

Remediation

Fix · CNA pulseaudio (Canonical) Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, 1:8.0-0ubuntu3.15

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Timeline

2026-10-02 Threatist record created from CVE-2020-16123
2026-10-03 Alias added: GHSA-h38w-g4mp-rwv7

References

Exploit 1

https://launchpad.net/bugs/1895928

Patch 1

https://ubuntu.com/USN-4640-1

TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8

See all 4120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences