What is the CVSS score of CVE-2024-28085?

CVE-2024-28085 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 10.2%.

Is there a public PoC exploit available for CVE-2024-28085?

Yes, a public proof-of-concept exploit is available for CVE-2024-28085. Prioritise patching immediately. EPSS: 10.2%.

Is there a patch available for CVE-2024-28085?

Yes, a patch is available for CVE-2024-28085. Update the affected software to the latest version immediately.

Util Linux CVE-2024-28085

LOW

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2024-03-27 cve@mitre.org

Information Disclosure Util Linux Debian Linux

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Mar 27, 2024 - 19:15 cve.org

LOW 3.3

DescriptionCVE.org

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

AnalysisAI

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 10.2%.

Technical ContextAI

This vulnerability is classified under CWE-150. wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover. Affected products include: Kernel Util-Linux, Debian Debian Linux. Version information: through 2.40.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.