CVE-2020-16123: canonical pulseaudio Race Condition
Vulnerability summary
CVE-2020-16123 is a medium (CVSS 4.7) Race Condition vulnerability in canonical pulseaudio. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-12-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA4.4MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
0.00 pp
From 0.32% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (launchpad.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Canonical2 products
- pulseaudio≥ 1:13.99.3-1, < 1:13.99.3-1ubuntu2 | ≥ 1:13.99.2-1, < 1:13.99.2-1ubuntu2.1 | ≥ 1:13.99.1-1, < 1:13.99.1-1ubuntu3.8 | ≥ 1:11.1-1, < 1:11.1-1ubuntu7.11 | ≥ 1:8.0-0, < 1:8.0-0ubuntu3.15
- ubuntu_linuxEOL16.04 | 18.04 | 20.04 | 20.10
Ubuntu1 product
- pulseaudio< 1:8.0-0ubuntu3.15 | < 1:11.1-1ubuntu7.11 | < 1:13.99.1-1ubuntu3.8
2 vendors · 3 products
References
5 links- launchpad.net/bugs/1895928Vendor AdvisoryX Refsource UBUNTUExploitIssue TrackingThird Party Advisory