Bouzas: PipeWire, the media service transforming the Linux multimedia landscape

Posted Mar 6, 2020 11:46 UTC (Fri) by alexl (subscriber, #19068)
In reply to: Bouzas: PipeWire, the media service transforming the Linux multimedia landscape by roc
Parent article: Bouzas: PipeWire, the media service transforming the Linux multimedia landscape

All sort of stuff, like:
* Record audio from a microphone.
* Listen to the output of other running apps
* Turn down the volume of other apps
* Load and configure modules into the pulseaudio daemon

Bouzas: PipeWire, the media service transforming the Linux multimedia landscape

Posted Mar 6, 2020 17:10 UTC (Fri) by mcatanzaro (subscriber, #93033) [Link] (2 responses)

"Load and configure modules into the pulseaudio daemon"

Does this mean: "execute arbitrary code"? It sure sounds like that's what it means.

Bouzas: PipeWire, the media service transforming the Linux multimedia landscape

Posted Mar 6, 2020 17:45 UTC (Fri) by smurf (subscriber, #17840) [Link]

No, the module are loaded from /usr/lib/pulse-VERSION/modules. The problem is that nobody prevents you from loading 1000 modules, linking their streams in interesting ways, and sending them some CPU- or network-intense data.

Bouzas: PipeWire, the media service transforming the Linux multimedia landscape

Posted Mar 9, 2020 15:29 UTC (Mon) by alexl (subscriber, #19068) [Link]

Not by design, you can't just point it to some .so and load that. However, I wouldn't be shocked if there is an exploit somewhere in some module you can trigger.