Permissions, Privileges, and Access Controls in pipewire - #VU78954

Vulnerability identifier: #VU78954

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions in pipewire/impl-link.c. A local application with permissions to access one stream can also access other streams.

pipewire
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
Desktop Applications Module
SUSE Package Hub 15
openSUSE Leap
pipewire-modules-debuginfo
pipewire-modules-32bit-debuginfo
pipewire-modules-32bit
pipewire-modules
pipewire-tools-debuginfo
pipewire-modules-0_3-64bit-debuginfo
pipewire-modules-0_3-32bit-debuginfo
libpipewire-0_3-0-32bit-debuginfo
pipewire-modules-0_3-32bit
pipewire-libjack-0_3-32bit
pipewire-spa-plugins-0_2-32bit-debuginfo
pipewire-alsa-32bit-debuginfo
pipewire-libjack-0_3-32bit-debuginfo
pipewire-spa-plugins-0_2-32bit
libpipewire-0_3-0-32bit
pipewire-alsa-32bit
pipewire-lang
pipewire-spa-plugins-0_2-64bit
pipewire-libjack-0_3-64bit
pipewire-modules-0_3-64bit
pipewire-libjack-0_3-64bit-debuginfo
pipewire-spa-plugins-0_2-64bit-debuginfo
pipewire-alsa-64bit-debuginfo
libpipewire-0_3-0-64bit-debuginfo
pipewire-alsa-64bit
libpipewire-0_3-0-64bit
pipewire-debuginfo
pipewire-libjack-0_3-devel
libpipewire-0_3-0
pipewire
pipewire-modules-0_3
pipewire-libjack-0_3-debuginfo
pipewire-alsa-debuginfo
pipewire-pulseaudio-debuginfo
pipewire-spa-plugins-0_2-debuginfo
pipewire-spa-plugins-0_2
pipewire-doc
pipewire-spa-tools
pipewire-alsa
libpipewire-0_3-0-debuginfo
pipewire-spa-tools-debuginfo
pipewire-libjack-0_3
gstreamer-plugin-pipewire
pipewire-debugsource
gstreamer-plugin-pipewire-debuginfo
pipewire-pulseaudio
pipewire-tools
pipewire-devel
pipewire-modules-0_3-debuginfo
pipewire-module-x11-0_3
pipewire-module-x11-0_3-debuginfo

Install updates from vendor's website.

pipewire - update to 0.3.75
pipewire-modules-debuginfo - update to 0.3.24-150300.4.6.1
pipewire-modules-32bit-debuginfo - update to 0.3.24-150300.4.6.1
pipewire-modules-32bit - update to 0.3.24-150300.4.6.1
pipewire-modules - update to 0.3.24-150300.4.6.1
pipewire-tools-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-modules-0_3-64bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-modules-0_3-32bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
libpipewire-0_3-0-32bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-modules-0_3-32bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-libjack-0_3-32bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-plugins-0_2-32bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-alsa-32bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-libjack-0_3-32bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-plugins-0_2-32bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
libpipewire-0_3-0-32bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-alsa-32bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-lang - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-plugins-0_2-64bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-libjack-0_3-64bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-modules-0_3-64bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-libjack-0_3-64bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-plugins-0_2-64bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-alsa-64bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
libpipewire-0_3-0-64bit-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-alsa-64bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
libpipewire-0_3-0-64bit - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-libjack-0_3-devel - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
libpipewire-0_3-0 - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-modules-0_3 - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-libjack-0_3-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-alsa-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-pulseaudio-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-plugins-0_2-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-plugins-0_2 - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-doc - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-tools - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-alsa - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
libpipewire-0_3-0-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-spa-tools-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-libjack-0_3 - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
gstreamer-plugin-pipewire - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-debugsource - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
gstreamer-plugin-pipewire-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-pulseaudio - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-tools - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-devel - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-modules-0_3-debuginfo - addressed in versions 0.3.49-150400.3.3.1, 0.3.64-150500.3.3.1
pipewire-module-x11-0_3 - update to 0.3.64-150500.3.3.1
pipewire-module-x11-0_3-debuginfo - update to 0.3.64-150500.3.3.1

• https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/9e0932b319203479cb6837b41d4cb7e388063eb3
• https://gitlab.freedesktop.org/pipewire/wireplumber/-/issues/218

• Security restrictions bypass in pipewire
• SUSE update for pipewire
• SUSE update for pipewire
• SUSE update for pipewire