Decade-old Linux ‘wall’ bug helps make fake SUDO prompts, steal passwords

A vulnerability in the wall command of the util-linux package that is part of the Linux operating system could allow an unprivileged attacker to steal passwords or change the victim's clipboard. Tracked as CVE-2024-28085, the security issue has been dubbed WallEscape and has been present in every version of the package for the past 11 years up to 2.40 released yesterday. Although the vulnerability is an interesting example of how an attacker can deceive a user into giving their administrator password, exploiting is likely limited to certain scenarios. An attacker needs to have access to a Linux server that already has multiple users connected at the same time through the terminal, such as a college where students may connect for an assignment. Security researcher Skyler Ferrante discovered WallEscape, which is described as an "improper neutralization of escape sequences in wall" command. WallEscape impacts the ‘wall’ command, which is typically used in Linux systems to broadcast messages to the terminals of all users logged to the same system, such as a server. Because escape sequences are improperly filtered when processing input through command line arguments, an unprivileged user could exploit the vulnerability using escape control characters to create a fake SUDO prompt on other users' terminals and trick them into typing their administrator password. The security issue can be exploited under certain conditions. Ferrante explains that exploitation is possible if the "mes...