Executive brief
A vulnerability in the 'wall' command-line utility, used to send messages to all logged-in users, allows an attacker to send malicious terminal escape sequences to other users. On certain Linux systems like Ubuntu and Debian, this can be used to trick users into revealing their passwords by spoofing sudo prompts or manipulating the terminal display. This could lead to unauthorized account access if a user is deceived by the faked terminal output.
Technical details
The 'wall' utility in util-linux (introduced in commit cdd3cc7fa4) fails to sanitize escape sequences when they are provided as command-line arguments (argv), although it correctly sanitizes input from stdin using fputs_careful(). On distributions where 'wall' is installed with setgid tty permissions and 'mesg' is enabled by default (such as Ubuntu 22.04 and Debian Bookworm), a local unprivileged attacker can inject ANSI escape sequences into the terminals of other logged-in users. This can be leveraged to create fake sudo prompts or manipulate terminal clipboards. On Ubuntu, this is specifically exploitable to leak passwords by tricking users into typing their credentials as commands when a 'command-not-found' handler is active. The issue is fixed in util-linux version 2.40.1 and via various distribution patches.
Affected products
- kernel.org util-linux 2.24 through 2.40
- Debian Debian Linux 10.0, 11.0, 12.0
- Canonical Ubuntu Linux 22.04
Timeline
- 2013-01-01: other: Vulnerable code introduced in commit cdd3cc7fa4
- 2024-03-27: disclosed: Public disclosure on oss-security mailing list
- 2024-03-27: patched: Upstream fix committed to util-linux repository
- 2024-03-27: advisory: CVE-2024-28085 assigned and published
References
- http://www.openwall.com/lists/oss-security/2024/03/27/5
- http://www.openwall.com/lists/oss-security/2024/03/27/6
- http://www.openwall.com/lists/oss-security/2024/03/27/7
- http://www.openwall.com/lists/oss-security/2024/03/27/8
- http://www.openwall.com/lists/oss-security/2024/03/27/9
- http://www.openwall.com/lists/oss-security/2024/03/28/1
- http://www.openwall.com/lists/oss-security/2024/03/28/2