CVE-2009-1894
CVE-2009-1894 is a high-severity vulnerability in Pulseaudio with a CVSS 2.0 base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-362.
Key facts
- Severity: High (CVSS 2.0 base score 7.2)
- EPSS exploit prediction: 1% (50th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-362
- Affected product: Pulseaudio
- Published:
- Last modified:
Description
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.
Frequently asked questions
- What is CVE-2009-1894?
- Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.
- How severe is CVE-2009-1894?
- CVE-2009-1894 has a CVSS 2.0 base score of 7.2, rated high severity.
- Is CVE-2009-1894 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-1894?
- CVE-2009-1894 primarily affects Pulseaudio. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-1894?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2009-1894 published?
- CVE-2009-1894 was published on 2009-07-17 and last updated on 2026-06-16.
References
- http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html
- http://secunia.com/advisories/35868
- http://secunia.com/advisories/35886
- http://secunia.com/advisories/35896
- http://security.gentoo.org/glsa/glsa-200907-13.xml
- http://taviso.decsystem.org/research.html
- http://www.akitasecurity.nl/advisory.php?id=AK20090602
- http://www.debian.org/security/2009/dsa-1838
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:152
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:171
- http://www.securityfocus.com/archive/1/505052/100/0/threaded
- http://www.securityfocus.com/bid/35721
- http://www.ubuntu.com/usn/usn-804-1
- https://admin.fedoraproject.org/updates/pulseaudio-0.9.10-1.el5.2
- https://bugzilla.redhat.com/show_bug.cgi?id=510071
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51804
Affected products (3)
- cpe:2.3:a:pulseaudio:pulseaudio:0.9.9:*:*:*:*:*:*:*
- cpe:2.3:a:pulseaudio:pulseaudio:0.9.10:*:*:*:*:*:*:*
- cpe:2.3:a:pulseaudio:pulseaudio:0.9.14:*:*:*:*:*:*:*
More vulnerabilities in Pulseaudio
- CVE-2007-1804 — High (CVSS 7.8): PulseAudio 0.9.5 allows remote attackers to cause a denial of service (daemon crash) via (1) a…
- CVE-2008-0008 — High (CVSS 7.2): The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1)…
- CVE-2009-1299 — Medium (CVSS 6.9): The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the…
- CVE-2024-11586 — Medium (CVSS 4.0): Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.
- CVE-2020-11931 — Low (CVSS 3.3): An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to…
- CVE-2014-3970 — Low (CVSS 2.9): The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote…
All CVEs affecting Pulseaudio →
Other CWE-362 (Race Condition) vulnerabilities
- CVE-2022-27626 — Critical (CVSS 10.0): A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition')…
- CVE-2015-8556 — Critical (CVSS 10.0): Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
- CVE-2014-0703 — Critical (CVSS 10.0): Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition…
- CVE-2010-1228 — Critical (CVSS 10.0): Multiple race conditions in the sandbox infrastructure in Google Chrome before 4.1.249.1036 have unspecified impact and…
- CVE-2008-6598 — Critical (CVSS 10.0): Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic."
- CVE-2026-46137 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential…