CVE-2024-28085

util-linux wall Escape Sequence Injection

Severity Score

3.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

wall en util-linux hasta 2.40, a menudo instalado con permisos setgid tty, permite enviar secuencias de escape a terminales de otros usuarios a través de argv. (Específicamente, las secuencias de escape recibidas de stdin están bloqueadas, pero las secuencias de escape recibidas de argv no están bloqueadas). Puede haber escenarios plausibles en los que esto conduzca a la apropiación de cuentas.

The util-linux wall command does not filter escape sequences from command line arguments. The vulnerable code was introduced in commit cdd3cc7fa4 (2013). Every version since has been vulnerable. This allows unprivileged users to put arbitrary text on other users terminals, if mesg is set to y and wall is setgid. CentOS is not vulnerable since wall is not setgid. On Ubuntu 22.04 and Debian Bookworm, wall is both setgid and mesg is set to y by default.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-03-03 CVE Reserved
2024-03-27 CVE Published
2024-05-02 EPSS Updated
2024-08-26 CVE Updated
2024-08-26 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

CAPEC

References (16)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/03/27/5	Mailing List
http://www.openwall.com/lists/oss-security/2024/03/27/6	Mailing List
http://www.openwall.com/lists/oss-security/2024/03/27/7	Mailing List
http://www.openwall.com/lists/oss-security/2024/03/27/8	Mailing List
http://www.openwall.com/lists/oss-security/2024/03/27/9	Mailing List
http://www.openwall.com/lists/oss-security/2024/03/28/1	Mailing List
http://www.openwall.com/lists/oss-security/2024/03/28/2	Mailing List
http://www.openwall.com/lists/oss-security/2024/03/28/3	Mailing List
https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq
https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html	Mailing List
https://mirrors.edge.kernel.org/pub/linux/utils/util-linux
https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt
https://security.netapp.com/advisory/ntap-20240531-0003
https://www.openwall.com/lists/oss-security/2024/03/27/5

URL	Date	SRC
https://github.com/skyler-ferrante/CVE-2024-28085	2024-08-26
https://github.com/oditynet/sleepall	2024-12-02

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Kernel Search vendor "Kernel"		Util-linux Search vendor "Kernel" for product "Util-linux"				*		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				*		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				*		-		Affected
Huawei Search vendor "Huawei"		Euleros Search vendor "Huawei" for product "Euleros"				*		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				*		-		Affected
Slackware Search vendor "Slackware"		Slackware Linux Search vendor "Slackware" for product "Slackware Linux"				*		-		Affected
Suse Search vendor "Suse"		Sle-module-basesystem Search vendor "Suse" for product "Sle-module-basesystem"				*		-		Affected
Suse Search vendor "Suse"		Sle-module-server-applications Search vendor "Suse" for product "Sle-module-server-applications"				*		-		Affected
Suse Search vendor "Suse"		Sle-sdk Search vendor "Suse" for product "Sle-sdk"				*		-		Affected
Suse Search vendor "Suse"		Sle-we Search vendor "Suse" for product "Sle-we"				*		-		Affected
Suse Search vendor "Suse"		Sle Hpc-espos Search vendor "Suse" for product "Sle Hpc-espos"				*		-		Affected
Suse Search vendor "Suse"		Sle Hpc-ltss Search vendor "Suse" for product "Sle Hpc-ltss"				*		-		Affected
Suse Search vendor "Suse"		Sle Hpc Search vendor "Suse" for product "Sle Hpc"				*		-		Affected
Suse Search vendor "Suse"		Sled Search vendor "Suse" for product "Sled"				*		-		Affected
Suse Search vendor "Suse"		Sles-ltss Search vendor "Suse" for product "Sles-ltss"				*		-		Affected
Suse Search vendor "Suse"		Sles Search vendor "Suse" for product "Sles"				*		-		Affected
Suse Search vendor "Suse"		Sles Sap Search vendor "Suse" for product "Sles Sap"				*		-		Affected
Suse Search vendor "Suse"		Suse-manager-proxy Search vendor "Suse" for product "Suse-manager-proxy"				*		-		Affected
Suse Search vendor "Suse"		Suse-manager-server Search vendor "Suse" for product "Suse-manager-server"				*		-		Affected