CVE-2019-13351: High severity jack audio connection kit (jack2) vulnerability
posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which can result in unintended information disclosure, crashes, or file corruption due to having the wrong file associated with the file descriptor.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-13351?
CVE-2019-13351 is a vulnerability in JACK2 and alsa-plugins that allows for exploitation through a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running.
How severe is CVE-2019-13351?
CVE-2019-13351 has a severity score of 8.1 (high).
Which software versions are affected by CVE-2019-13351?
JACK2 versions 1.9.1 through 1.9.12 and alsa-plugins version 1.1.7 and later are affected by CVE-2019-13351.
How can CVE-2019-13351 be exploited?
Exploitation of CVE-2019-13351 depends on the timing of the double file descriptor close issue during a failed connection attempt when jackd2 is not running.
Are there any references for CVE-2019-13351?
Yes, you can find references for CVE-2019-13351 on GitHub at the following links: [link1](https://github.com/jackaudio/jack2/pull/480) and [link2](https://github.com/xbmc/xbmc/issues/16258).