Summary
USN-6719-1 fixed a vulnerability in util-linux. Unfortunately, it was
discovered that the fix did not fully address the issue. This update
removes the setgid permission bit from the wall and write utilities.
Original advisory details:
Skyler Ferrante discovered that the util-linux wall command did not filter
escape sequences from command line arguments. A local attacker could
possibly use this issue to obtain sensitive information.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | util-linux | 2.34-0.1ubuntu9.6 |
| Ubuntu · 22.04 LTS 22.04:LTS | util-linux | 2.37.2-4ubuntu3.4 |
Vulnerabilities 1
-
Low 3.3CVE-2024-28085 Public exploit
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to oth…
References
-
report
https://ubuntu.com/security/CVE-2024-28085