CVE-2024-28085: Escape sequence injection in util-linux wall
wall in util-linux through 2.40 often installed with setgid tty permissions allows escape sequences to be sent to other users' terminals through argv. (Specifically escape sequences received from stdin are blocked but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.
Other sources
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/util-linuxto a version that resolves this vulnerability.Fixed in 2.34-0.1ubuntu9.5 - Upgrade
Upgrade
ubuntu/util-linuxto a version that resolves this vulnerability.Fixed in 2.37.2-4ubuntu3.3 - Upgrade
Upgrade
ubuntu/util-linuxto a version that resolves this vulnerability.Fixed in 2.39.1-4ubuntu2.1 - Upgrade
Upgrade
ubuntu/util-linuxto a version that resolves this vulnerability.Fixed in 2.39.3-9ubuntu6 - Upgrade
Upgrade
alpine/util-linuxto a version that resolves this vulnerability.Fixed in 2.40-r0 - Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.38.1-5+deb12u1 - Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.39.3-11 - Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.38.1-5+deb12u3Fixed in 2.38.1-5+deb12u1Fixed in 2.41.5-0+deb13u1Fixed in 2.42.4-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-28085?
CVE-2024-28085 is classified as a vulnerability that can allow unauthorized escape sequences to affect other users' terminals.
How do I fix CVE-2024-28085?
To mitigate CVE-2024-28085, you should update the util-linux package to a version beyond the specified vulnerable versions listed in the advisory.
Which versions of util-linux are affected by CVE-2024-28085?
CVE-2024-28085 affects util-linux versions before 2.40, specifically those installed with setgid tty permissions.
What systems are impacted by CVE-2024-28085?
CVE-2024-28085 impacts systems running vulnerable versions of util-linux on Ubuntu and Debian distributions.
Can CVE-2024-28085 lead to password theft?
Yes, CVE-2024-28085 can potentially allow an attacker to create fake sudo prompts, leading to password theft.