Thank you for the insight, Charles.

We confirmed that applying the "shallow fix" (checking for NULL instead
of asserting) prevents the crash and allows the daemon to continue
running, although it might leave the device in a zombie state.

Since this `pa_assert` failure allows a remote attacker to terminate the
PulseAudio service (Denial of Service) via crafted RFCOMM packets, we
believe this should be handled gracefully rather than aborting the
process. We are currently analyzing the upstream logic to see why the
transport is not initialized correctly during this specific state
transition.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2121311

Title:
  pulseaudio aborts in pa_bluetooth_transport_set_state()
  (Bluetooth/BlueZ integration)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pulseaudio/+bug/2121311/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to