Input validation error in Util-linux - CVE-2024-28085

Vulnerability identifier: #VU87906

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-28085

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied arguments along with setgid tty permissions within the wall command. A local user can execute arbitrary commands with escalated privileges on the system.

Util-linux
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Anolis OS
SUSE Enterprise Storage
SUSE Linux Enterprise Workstation Extension 12
Slackware Linux
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Server Applications Module
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
SmartFabric Storage Software
RecoverPoint for Virtual Machines
SmartFabric OS10
PowerStore X
PowerStore T
Storage Resource Manager
EMC Cloud Tiering Appliance
Dell Data Protection Central
util-linux
libuuid-devel
libuuid
libsmartcols-devel
libsmartcols
libmount-devel
libmount
libblkid-devel
libblkid
uuidd
util-linux-lang
libmount1-debuginfo-32bit
libmount1-32bit
libblkid1-debuginfo-32bit
libblkid1-32bit
libuuid1-32bit
libuuid1-debuginfo-32bit
libblkid1
libfdisk1-debuginfo
util-linux-debuginfo
util-linux-debugsource
libuuid1
libsmartcols1
python-libmount
util-linux-systemd-debugsource
libsmartcols1-debuginfo
uuidd-debuginfo
python-libmount-debugsource
libuuid1-debuginfo
libfdisk1
util-linux-systemd-debuginfo
python-libmount-debuginfo
libblkid1-debuginfo
libmount1
libmount1-debuginfo
util-linux-systemd
libfdisk-devel
libuuid1-32bit-debuginfo
libblkid1-32bit-debuginfo
libmount1-32bit-debuginfo
libblkid-devel-static
libuuid-devel-static
util-linux (Ubuntu package)
util-linux-user
libfdisk
util-linux-devel
util-linux-help
util-linux (Debian package)
libsmartcols-devel-32bit
libblkid-devel-32bit
libuuid-devel-32bit
libsmartcols1-32bit
libsmartcols1-32bit-debuginfo
libmount-devel-static
python3-libmount-debuginfo
libmount-devel-32bit
libfdisk1-32bit
libfdisk1-32bit-debuginfo
libfdisk-devel-32bit
libmount-devel-64bit
libsmartcols1-64bit-debuginfo
libmount1-64bit-debuginfo
libfdisk-devel-64bit
libuuid1-64bit-debuginfo
libsmartcols1-64bit
libuuid1-64bit
libfdisk1-64bit
libblkid-devel-64bit
libfdisk-devel-static
libfdisk1-64bit-debuginfo
libblkid1-64bit-debuginfo
libsmartcols-devel-64bit
libmount1-64bit
libblkid1-64bit
libuuid-devel-64bit
python3-libmount-debugsource
python3-libmount
libsmartcols-devel-static
util-linux-core
Dell EMC Storage Monitoring and Reporting (SMR)
Dell Secure Connect Gateway
Dell EMC VxRail Appliance
IBM CICS TX Advanced

Install update from vendor's website.

SmartFabric Storage Software - update to 1.4.3
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
SmartFabric OS10 - update to 10.5.4.11
util-linux - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libuuid-devel - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libuuid - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libsmartcols-devel - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libsmartcols - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libmount-devel - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libmount - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libblkid-devel - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libblkid - addressed in versions 2.23.2-66.0.1, 2.39.1-2
uuidd - addressed in versions 2.23.2-66.0.1, 2.39.1-2
libsmartcols-devel - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux-lang - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount1-debuginfo-32bit - update to 2.33.2-4.36.1
libmount1-32bit - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid1-debuginfo-32bit - update to 2.33.2-4.36.1
libblkid1-32bit - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid1-32bit - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid1-debuginfo-32bit - update to 2.33.2-4.36.1
libblkid1 - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk1-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid-devel - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount-devel - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid-devel - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux-debugsource - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid1 - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols1 - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
python-libmount - update to 2.33.2-4.36.1
util-linux-systemd-debugsource - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols1-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
uuidd-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
python-libmount-debugsource - update to 2.33.2-4.36.1
uuidd - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid1-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk1 - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux-systemd-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
python-libmount-debuginfo - update to 2.33.2-4.36.1
libblkid1-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount1 - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount1-debuginfo - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux-systemd - addressed in versions 2.33.2-4.36.1, 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk-devel - addressed in versions 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid1-32bit-debuginfo - addressed in versions 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid1-32bit-debuginfo - addressed in versions 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount1-32bit-debuginfo - addressed in versions 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid-devel-static - addressed in versions 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid-devel-static - addressed in versions 2.33.2-150100.4.45.1, 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux (Ubuntu package) - addressed in versions 2.34-0.1ubuntu9.5, 2.34-0.1ubuntu9.6, 2.37.2-4ubuntu3.3, 2.37.2-4ubuntu3.4, 2.39.1-4ubuntu2.1, 2.39.1-4ubuntu2.2
util-linux - addressed in versions 2.35.2-13, 2.35.2-16
python-libmount - addressed in versions 2.35.2-13, 2.35.2-16
util-linux-user - addressed in versions 2.35.2-13, 2.35.2-16
util-linux-debuginfo - addressed in versions 2.35.2-13, 2.35.2-16
libblkid - addressed in versions 2.35.2-13, 2.35.2-16
uuidd - addressed in versions 2.35.2-13, 2.35.2-16
libmount - addressed in versions 2.35.2-13, 2.35.2-16
libfdisk - addressed in versions 2.35.2-13, 2.35.2-16
util-linux-devel - addressed in versions 2.35.2-13, 2.35.2-16
libuuid - addressed in versions 2.35.2-13, 2.35.2-16
util-linux-debugsource - addressed in versions 2.35.2-13, 2.35.2-16
libsmartcols - addressed in versions 2.35.2-13, 2.35.2-16
util-linux-help - addressed in versions 2.35.2-13, 2.35.2-16
util-linux (Debian package) - addressed in versions 2.36.1-8+deb11u2, 2.38.1-5+deb12u1
libsmartcols-devel-32bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid-devel-32bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid-devel-32bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols1-32bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols1-32bit-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount-devel-static - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
python3-libmount-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount-devel-32bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk1-32bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk1-32bit-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk-devel-32bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount-devel-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols1-64bit-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount1-64bit-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk-devel-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid1-64bit-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols1-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid1-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk1-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid-devel-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk-devel-static - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libfdisk1-64bit-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid1-64bit-debuginfo - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols-devel-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libmount1-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libblkid1-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libuuid-devel-64bit - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
python3-libmount-debugsource - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
python3-libmount - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
libsmartcols-devel-static - addressed in versions 2.36.2-150300.4.41.1, 2.37.2-150400.8.29.1, 2.37.4-150500.9.6.1
util-linux - update to 2.37.4
util-linux-core - update to 2.39.1-2
python3-libmount - update to 2.39.1-2
libfdisk-devel - update to 2.39.1-2
libfdisk - update to 2.39.1-2
PowerStore X - update to 3.2.1.4-2386214
PowerStore T - update to 4.0.0.2-2365061
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Storage Resource Manager - update to 5.0.1.0
Dell Secure Connect Gateway - update to 5.24.00.14
Dell EMC VxRail Appliance - update to 8.0.212
IBM CICS TX Advanced - update to 10.1.0.0 ifix29
EMC Cloud Tiering Appliance - update to 13.2.0.2.29
Dell Data Protection Central - update to 19.11.0-2

• Exploit #9803 - CVE-2024-28085 (May 13, 2024)

• https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt
• https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq
• https://www.openwall.com/lists/oss-security/2024/03/27/5
• https://github.com/skyler-ferrante/CVE-2024-28085

• Privilege escalation in util-linux wall
• Ubuntu update for util-linux
• Slackware Linux update for util-linux
• SUSE update for util-linux
• openEuler update for util-linux
• SUSE update for util-linux
• SUSE update for util-linux
• SUSE update for util-linux
• SUSE update for util-linux
• Ubuntu update for util-linux
• openEuler 20.03 LTS SP1 update for util-linux
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Debian update for util-linux
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in Dell PowerStore X
• Multiple vulnerabilities in Dell PowerStore T Family
• Anolis OS update for util-linux
• Anolis OS update for util-linux
• Dell SmartFabric Storage Software update for third-party components
• Dell RecoverPoint for Virtual Machines update for third-party components