CVE-2024-28085 - OpenCVE

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/03/27/5
http://www.openwall.com/lists/oss-security/2024/03/27/6
http://www.openwall.com/lists/oss-security/2024/03/27/7
http://www.openwall.com/lists/oss-security/2024/03/27/8
http://www.openwall.com/lists/oss-security/2024/03/27/9
http://www.openwall.com/lists/oss-security/2024/03/28/1
http://www.openwall.com/lists/oss-security/2024/03/28/2
http://www.openwall.com/lists/oss-security/2024/03/28/3
https://github.com/skyler-ferrante/CVE-2024-28085
https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq
https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html
https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/
https://nvd.nist.gov/vuln/detail/CVE-2024-28085
https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt
https://security.netapp.com/advisory/ntap-20240531-0003/
https://www.cve.org/CVERecord?id=CVE-2024-28085
https://www.openwall.com/lists/oss-security/2024/03/27/5

History

Mon, 26 Aug 2024 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-150
Metrics	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}`	cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-03-27T00:00:00

Updated: 2024-08-26T20:25:27.912Z

Reserved: 2024-03-03T00:00:00

Link: CVE-2024-28085

Vulnrichment

Updated: 2024-08-02T00:48:48.228Z

NVD

Status : Awaiting Analysis

Published: 2024-03-27T19:15:48.367

Modified: 2024-08-26T21:35:09.310

Link: CVE-2024-28085

Redhat

Severity : Important

Publid Date: 2024-03-27T00:00:00Z

Links: CVE-2024-28085 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-28085", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-26T20:25:27.912Z", "dateReserved": "2024-03-03T00:00:00", "datePublished": "2024-03-27T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-10T16:11:00.153251"}, "descriptions": [{"lang": "en", "value": "wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt"}, {"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq"}, {"url": "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/"}, {"url": "https://www.openwall.com/lists/oss-security/2024/03/27/5"}, {"url": "https://github.com/skyler-ferrante/CVE-2024-28085"}, {"name": "[debian-lts-announce] 20240407 [SECURITY] [DLA 3782-1] util-linux security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html"}, {"name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/28/1"}, {"name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/6"}, {"name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/9"}, {"name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/8"}, {"name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/7"}, {"name": "[oss-security] 20240328 Re: Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/28/2"}, {"name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/28/3"}, {"name": "[oss-security] 20240327 CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/5"}, {"url": "https://security.netapp.com/advisory/ntap-20240531-0003/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.228Z"}, "title": "CVE Program Container", "references": [{"url": "https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt", "tags": ["x_transferred"]}, {"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq", "tags": ["x_transferred"]}, {"url": "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/", "tags": ["x_transferred"]}, {"url": "https://www.openwall.com/lists/oss-security/2024/03/27/5", "tags": ["x_transferred"]}, {"url": "https://github.com/skyler-ferrante/CVE-2024-28085", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20240407 [SECURITY] [DLA 3782-1] util-linux security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html"}, {"name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/28/1"}, {"name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/6"}, {"name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/9"}, {"name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/8"}, {"name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/7"}, {"name": "[oss-security] 20240328 Re: Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/28/2"}, {"name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/28/3"}, {"name": "[oss-security] 20240327 CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/27/5"}, {"url": "https://security.netapp.com/advisory/ntap-20240531-0003/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-150", "lang": "en", "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "affected": [{"vendor": "kernel", "product": "util-linux", "cpes": ["cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.40", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-26T20:25:25.196139Z", "id": "CVE-2024-28085", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T20:25:27.912Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt", "tags": ["x_transferred"]}, {"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq", "tags": ["x_transferred"]}, {"url": "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/", "tags": ["x_transferred"]}, {"url": "https://www.openwall.com/lists/oss-security/2024/03/27/5", "tags": ["x_transferred"]}, {"url": "https://github.com/skyler-ferrante/CVE-2024-28085", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html", "name": "[debian-lts-announce] 20240407 [SECURITY] [DLA 3782-1] util-linux security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/28/1", "name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/6", "name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/9", "name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/8", "name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/7", "name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/28/2", "name": "[oss-security] 20240328 Re: Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/28/3", "name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/5", "name": "[oss-security] 20240327 CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240531-0003/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.228Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-28085", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-26T20:25:25.196139Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:*"], "vendor": "kernel", "product": "util-linux", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.40"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T20:20:18.568Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt"}, {"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq"}, {"url": "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/"}, {"url": "https://www.openwall.com/lists/oss-security/2024/03/27/5"}, {"url": "https://github.com/skyler-ferrante/CVE-2024-28085"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html", "name": "[debian-lts-announce] 20240407 [SECURITY] [DLA 3782-1] util-linux security update", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/28/1", "name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/6", "name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/9", "name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/8", "name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/7", "name": "[oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/28/2", "name": "[oss-security] 20240328 Re: Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/28/3", "name": "[oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/27/5", "name": "[oss-security] 20240327 CVE-2024-28085: Escape sequence injection in util-linux wall", "tags": ["mailing-list"]}, {"url": "https://security.netapp.com/advisory/ntap-20240531-0003/"}], "descriptions": [{"lang": "en", "value": "wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-10T16:11:00.153251"}}}, "cveMetadata": {"cveId": "CVE-2024-28085", "state": "PUBLISHED", "dateUpdated": "2024-08-26T20:25:27.912Z", "dateReserved": "2024-03-03T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-03-27T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover."}, {"lang": "es", "value": "wall en util-linux hasta 2.40, a menudo instalado con permisos setgid tty, permite enviar secuencias de escape a terminales de otros usuarios a trav\u00e9s de argv. (Espec\u00edficamente, las secuencias de escape recibidas de stdin est\u00e1n bloqueadas, pero las secuencias de escape recibidas de argv no est\u00e1n bloqueadas). Puede haber escenarios plausibles en los que esto conduzca a la apropiaci\u00f3n de cuentas."}], "id": "CVE-2024-28085", "lastModified": "2024-08-26T21:35:09.310", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-03-27T19:15:48.367", "references": [{"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/27/5"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/27/6"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/27/7"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/27/8"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/27/9"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/28/1"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/28/2"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/28/3"}, {"source": "cve@mitre.org", "url": "https://github.com/skyler-ferrante/CVE-2024-28085"}, {"source": "cve@mitre.org", "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html"}, {"source": "cve@mitre.org", "url": "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/"}, {"source": "cve@mitre.org", "url": "https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20240531-0003/"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2024/03/27/5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-150"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}