3 ms·

I think the whole pulse audio thing is just for a little entertainment. Check the description in "exploit.c".

• nailer 17y ago
  My understanding is that it uses pulseaudio to avoid null pointer dereference protection, but the hole is in the tunneling driver.
  • jmillikin 17y ago
    Any SUID binary which allows library loading would work for this purpose. Normally that's not a security problem, but a combination of other factors has allowed it to become one.
    • yosh 17y ago
      "Normally that's not a security problem" ? PulseAudio allowing arbitrary code loaded into a suid root app via command line parameters is a gaping security hole by itself. This exploit used a trivial root exploit to setup a deeper kernel level exploit, that can bypass SELinux, hide itself completely, etc.