Bug 2260027 (CVE-2022-4964)

Summary:	CVE-2022-4964 pipewire: grants microphone access even when the snap interface for audio-record
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was discovered in pipewire-pulse, where Snap allows microphone access even in the absence of a configured snap interface for audio recording.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2260028, 2260029
Bug Blocks:	2260030

Description Rohit Keshri 2024-01-24 07:11:56 UTC

Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.

https://bugs.launchpad.net/ubuntu/+source/pipewire/+bug/1995707/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4964
https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1779
https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567

Comment 1 Rohit Keshri 2024-01-24 07:13:53 UTC

Created pipewire tracking bugs for this issue:

Affects: fedora-all [bug 2260028]


Created pipewire0.2 tracking bugs for this issue:

Affects: fedora-all [bug 2260029]

Comment 3 Sandipan Roy 2024-01-25 04:22:51 UTC

This issue does not impact any Red Hat products since snapd is neither supported nor shipped in RHEL (Red Hat Enterprise Linux).