Security readout for executives and security teams
Plain-English summary
CVE-2024-28085 affects the wall utility in util-linux through 2.40. A local logged-in user may send terminal escape sequences to another user through command arguments. The direct CVSS impact is low, but shared shell servers deserve attention because terminal manipulation can support deception or account-compromise scenarios.
Executive priority
Handle through normal patch management, with earlier attention for shared interactive Linux environments. This is not KEV-listed in the supplied bundle, but local-user abuse can matter on bastions or multi-tenant systems.
Technical view
wall filters escape sequences from stdin but not from argv. On systems where wall is installed with setgid tty permissions, a low-privileged local user can write crafted terminal control sequences to other users' terminals. CVSS is 3.3, local attack vector, low integrity impact.
Likely exposure
Linux and Unix-like systems using util-linux wall through 2.40 are most relevant, especially multi-user servers where wall is setgid tty and untrusted users share interactive terminals.
Exploitation context
The bundle includes public researcher writeups and a public proof-of-concept repository. It does not include KEV listing or cited evidence of active exploitation in the wild.
Researcher notes
The key condition is argv-based terminal escape handling combined with wall's ability to write to other terminals. Validate vendor patches or backports rather than relying only on upstream version strings. Avoid assuming remote exposure from the supplied evidence.
Mitigation direction
- Update util-linux using vendor packages or vendor guidance.
- Prioritize shared shell, bastion, lab, and hosting systems.
- Check whether wall remains setgid tty where not operationally required.
- Review Debian, Siemens, NetApp, and distribution advisories for product-specific status.
- Restrict local shell access to trusted users where practical.
Validation and detection
- Inventory systems with util-linux wall installed.
- Confirm util-linux versions and vendor backport status.
- Check wall file permissions for setgid tty exposure.
- Review local multi-user terminal use cases and trust boundaries.
- Confirm vendor security updates are applied successfully.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-150: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-28085 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N1.81.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txtCVE reference, mitre
- https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjqCVE reference, mitre
- https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/CVE reference, mitre
- https://www.openwall.com/lists/oss-security/2024/03/27/5CVE reference, mitre
- https://github.com/skyler-ferrante/CVE-2024-28085CVE reference, mitre
- [debian-lts-announce] 20240407 [SECURITY] [DLA 3782-1] util-linux security updateCVE reference, mitre · mailing-list
- https://security.netapp.com/advisory/ntap-20240531-0003/CVE reference, mitre
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-202008.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Escape, Meta, or Control Sequences
Improper Neutralization of Escape, Meta, or Control Sequences represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.