CVE-2024-28085

What it actually does

The wall utility fails to sanitize escape sequences supplied via command-line arguments (argv), allowing a local process with access to invoke wall to inject terminal control sequences into other users' TTYs despite setgid tty restrictions that block stdin-sourced sequences.

Why it matters to the business

On multi-user systems where wall retains setgid tty privileges, local users may be able to manipulate other users' terminal sessions, potentially enabling account takeover or unauthorized actions with low operational disruption but elevated insider risk.

How an attack unfolds

An attacker on the same host invokes the wall binary directly, passing crafted escape sequences in the argument list rather than standard input; because argv is not filtered, the sequences reach the target TTYs and can alter display, capture input, or trigger session-level actions that lead to credential or session theft.

How to fix it

Upgrade util-linux to a build containing commit 8230dec4c50810065403eefe3c8cda475976e3eb or later; rebuild and reinstall any packages that ship wall; verify the binary no longer accepts unsanitized argv sequences.

How to confirm the fix worked

Run wall with a test escape sequence in argv and confirm the sequence is blocked or ignored; inspect package version or git commit to ensure 8230dec4c50810065403eefe3c8cda475976e3eb or newer is present; re-test setgid permissions and TTY access controls.

Typical attack path

1. Locate a setgid wall binary on a multi-user system
2. Craft a command line that supplies terminal escape sequences as argv[1..n]
3. Execute the wall invocation targeting other logged-in users
4. Observe or capture resulting terminal state changes that facilitate further actions such as keystroke injection or session hijacking

How to detect it

Search process execution logs and command-line audit records for wall invocations containing non-printable or escape characters in arguments; review TTY device access and any resulting session anomalies on multi-user hosts.

What your security team should do

• Prioritize patching util-linux packages to the fixed commit across all multi-user hosts
• Audit setgid binaries and consider dropping tty group privileges where wall is not required
• Monitor for unusual wall invocations via process auditing
• Review user account takeover scenarios on shared systems after upgrade