Log in Start free

Vulnerability · Published Mar 27, 2024 · Assigned by mitre

CVE-2024-28085

Low 3.3

In plain English

A low-severity security flaw in the util-linux package (Alpine). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)2.2%top 17.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20util-linux2.40-r0ALPINE-CVE-2024-28085
Alpine:v3.21util-linux2.40-r0ALPINE-CVE-2024-28085
Alpine:v3.22util-linux2.40-r0ALPINE-CVE-2024-28085
Alpine:v3.23util-linux2.40-r0ALPINE-CVE-2024-28085
Alpine:v3.24util-linux2.40-r0ALPINE-CVE-2024-28085
Debian:12util-linux2.38.1-5+deb12u1DSA-5650-1
Debian:12util-linux2.38.1-5+deb12u1DEBIAN-CVE-2024-28085
Debian:13util-linux2.39.3-11DEBIAN-CVE-2024-28085
Debian:14util-linux2.39.3-11DEBIAN-CVE-2024-28085
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu3.3USN-6719-1
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu3.4USN-6719-2
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu3.4UBUNTU-CVE-2024-28085
Ubuntu:24.04:LTSutil-linux2.39.3-9ubuntu6UBUNTU-CVE-2024-28085

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-150 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References