CVE-2024-28085: util-linux wall escape sequence injection in argv

CVE-2024-28085 · Severity: low · CVSS 3.3 · Published 2024-03-27

A vulnerability in the 'wall' command-line utility, used to send messages to all logged-in users, allows an attacker to send malicious terminal escape sequences to other users. On certain Linux systems like Ubuntu and Debian, this can be used to trick users into revealing their passwords by spoofing sudo prompts or manipulating the terminal display. This could lead to unauthorized account access if a user is deceived by the faked terminal output.

Technologies: Debian Linux, Kernel Util-Linux. Vendors: Debian, Kernel.

Quick answers

Is CVE-2024-28085 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-28085 being exploited in the wild.
How severe is CVE-2024-28085?
Low severity, with a CVSS score of 3.3, published 27 March 2024.
Which products and versions are affected?
kernel.org util-linux 2.24 through 2.40; Debian Debian Linux 10.0, 11.0, 12.0; Canonical Ubuntu Linux 22.04.
Is there a fix for CVE-2024-28085?
A patch was published on 2024-03-27: Upstream fix committed to util-linux repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-28085 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2024-28085?
Check whether you run Debian Linux or Kernel Util-Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'wall' utility in util-linux (introduced in commit cdd3cc7fa4) fails to sanitize escape sequences when they are provided as command-line arguments (argv), although it correctly sanitizes input from stdin using fputs_careful(). On distributions where 'wall' is installed with setgid tty permissions and 'mesg' is enabled by default (such as Ubuntu 22.04 and Debian Bookworm), a local unprivileged attacker can inject ANSI escape sequences into the terminals of other logged-in users. This can be leveraged to create fake sudo prompts or manipulate terminal clipboards. On Ubuntu, this is specifically exploitable to leak passwords by tricking users into typing their credentials as commands when a 'command-not-found' handler is active. The issue is fixed in util-linux version 2.40.1 and via various distribution patches.

Affected products

  • kernel.org util-linux 2.24 through 2.40
  • Debian Debian Linux 10.0, 11.0, 12.0
  • Canonical Ubuntu Linux 22.04

Timeline

  • 2013-01-01: other: Vulnerable code introduced in commit cdd3cc7fa4
  • 2024-03-27: disclosed: Public disclosure on oss-security mailing list
  • 2024-03-27: patched: Upstream fix committed to util-linux repository
  • 2024-03-27: advisory: CVE-2024-28085 assigned and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.