CVE-2022-4964

2024-01-2400:58:14

canonical

www.cve.org

ubuntu

pipewire-pulse

unauthorized access

microphone

snap interface

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Ubuntu’s pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.

CNA Affected

[
  {
    "packageName": "pipwire-pulse",
    "product": "Ubuntu pipewire-pulse",
    "vendor": "Canonical Ltd.",
    "platforms": [
      "Linux"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]