Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: WebKit-GTK + Puseaudio: unexpectedly high sound volume
From: cve-assign () mitre org
Date: Mon, 10 Feb 2014 13:40:49 -0500 (EST)

Hash: SHA1


The following combination of software has a nasty bug when used 
together, that I personally consider to be a vulnerability:

* PulseAudio (any version, especially when used in flat-volume mode that 
is the default everywhere except Ubuntu).
* Any browser based on Webkit-GTK 2.x (any version with HTML5 
audio/video support based on GStreamer).


For each of the two points below, there is a (non-100%) majority
supporting it.

1. This is not an audio issue. It is a sandboxing issue in Webkit-GTK.

(that's the statement that Arun needs to think about a bit more, but
which, I think, captures the most essential component of the problem,
even without flat volumes, due to disobeying sliders in pavucontrol if
a web app resets the volume using a periodic timer)

2. There is nothing to fix in PulseAudio code.

Comment 1

WebKitGtk+ is ok as it is now and complies with the standard, though I
agree with you that there's a security issue with the volume and I
think the problem is with the standard.

It is conceivable for a CVE assignment to apply to a combination of
two products, and not apply to either product alone, but we prefer not
to do that if there's any type of (partial) agreement that one product
could be chosen.

Use CVE-2013-7324 for this issue in WebKit-GTK. When the issue is
later listed on the
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7324 web page,
we will try to include a note that the WebKit-GTK behavior complies
with existing W3C standards and existing practices for GNOME desktop

PulseAudio's security model is based on clients not sending malicious
requests to change the stream volume

If there ever happens to be a later vendor announcement that this
model is incorrect, and that a different model is required as a
security fix, then a second CVE assignment could be made.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
Version: GnuPG v1.4.14 (SunOS)


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]