PT-2024-2532 · Unknown+6 · Util-Linux+6
Skyler Ferrante
·
Published
2024-03-27
·
Updated
2026-03-29
·
CVE-2024-28085
CVSS v2.0
6.2
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
util-linux versions prior to 2.40
Description
The
wall command in util-linux versions through 2.40 does not properly filter escape sequences received from command line arguments. This allows a local attacker to potentially inject escape sequences, which could lead to information disclosure or, in some scenarios, account takeover. The vulnerability has been present for over 11 years. A fix was initially released but did not fully address the issue, leading to a subsequent update that removes the setgid permission bit from the wall and write utilities.Recommendations
Upgrade to util-linux version 2.40 or later.
Remove the setgid permission bit from the
wall and write utilities.
Consider disabling the wall command.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Util-Linux