CVE-2024-28085
Kernel Util-Linux 2.24 – 2.39.4
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSummary
CVE-2024-28085 is a low-severity Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150) vulnerability in Kernel Util-Linux. Its CVSS base score is 3.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 19% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability affects the wall utility in util-linux versions through 2.40. When wall is installed with setgid tty permissions, it fails to sanitize escape sequences supplied via command-line arguments (argv), even though sequences received from stdin are blocked. This stems from improper handling of untrusted input as described under CWE-150 and carries a low CVSS score of 3.3.
A local attacker with access to execute wall can supply crafted escape sequences on the command line to write directly to other users' terminals. In plausible configurations this can be leveraged to manipulate terminal state or capture input, potentially resulting in account takeover.
The EPSS score remains low, with a current value of 0.1093 and a peak of 0.1274; the modest movement does not indicate material post-disclosure interest. Public discussion of the issue appears in oss-security mailing list threads from March 2024, though no specific patch or mitigation details are provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-25252
Vulnerability Data
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.)…
more
There may be plausible scenarios where this leads to account takeover.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10V1.3.12
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation/sanitization of inputs that directly stops escape/meta/control sequences from reaching downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and escaping to prevent this class of flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect the weakness but does not itself implement neutralization.
Secure development lifecycle mandates input validation and output encoding that directly neutralizes escape/meta sequences.
Application security requirements explicitly call for controls against injection and malformed input sequences.
Secure architecture principles reduce attack surface but do not prescribe specific neutralization techniques.
Secure coding standards require proper escaping and neutralization of control characters before downstream processing.