Skip to content

GHSA-4558-p62c-vv5v

CVE Information

Summary

CVE-2024-28085 ("WallEscape") fixed escape sequence injection in the util-linux wall(1) message body by adding fputs_careful() to the argv message path (term-utils/wall.c:394). The message headers, however, interpolate the system hostname with a raw snprintf/printf and remain unfixed. An unprivileged user can change the hostname of their own UTS namespace (unshare -Ur -u + sethostname(2)) to arbitrary bytes, including terminal escape sequences. Running wall(1)/write(1) inside that namespace delivers attacker-controlled escape sequences to the terminals of every user with messages enabled, including root. Same impact class as the original WallEscape: OSC 52 clipboard hijacking (paste -> command execution), OSC 8 hyperlink forgery, CSI screen spoofing / forged sudo prompts.

Details

term-utils/wall.c (master @ 39465c7):

378          snprintf(lbuf, lbuflen,
379                  _("Broadcast message from %s@%s (%s) (%s):"),
380                  whom, hostname, where, date);
381          fprintf(fs, "%-*.*s\007\007\r\n", TERM_WIDTH, TERM_WIDTH, lbuf);

The banner buffer lbuf (containing the hostname) is never sanitized. fputs_careful() is only used for message bodies (argv path wall.c:394, stdin path wall.c:423).

term-utils/write.c:381,385 (same issue in the greeting):

printf(_("Message from %s@%s on %s at %02d:%02d ..."),
       login, host, ctl->src_tty_name, ...);

The hostname originates from gethostname(2). Inside a user namespace with its own UTS namespace (unshare -Ur -u), an unprivileged user can set arbitrary bytes via sethostname(2).

PoC

$ unshare -Ur -u bash -c 'python3 -c "import ctypes; \
    h=b\"evil\x1b]52;c;UFdORUQ=\x1b\\\\\"; \
    ctypes.CDLL(None).sethostname(h, len(h))"'
$ wall hello

Note: sethostname(2) accepts arbitrary bytes; the hostname(1) utility rejects escape characters, hence the direct syscall wrapper. Prerequisite: victim has messages enabled (mesg y, default on Debian/Ubuntu); write(1) additionally requires the target user to have mesg enabled.

Verification: 1. sethostname with the full ESC OSC52 sequence: rc=0, hostname reads back intact (kernel 6.14). 2. wall(1)/write(1) banner bytes captured on a real pty: "Broadcast message from root@evil\x1b]52;c;UFdORUQ=\x1b\ (pts/0) ..." / "Message from root@evil\x1b]52;c;UFdORUQ=\x1b\ on pts/0 at ..." — payload decodes to b'PWNED'. 3. kitty terminal on X11 interpreted the identical sequence: X clipboard read back as 'PWNED'. 4. tmux with set-clipboard on: paste buffer + host clipboard both overwritten.

Note: the clipboard written by OSC 52 is the clipboard of the terminal emulator on the victim's own machine (X11 in our test; the same applies to Wayland, Windows Terminal, macOS/iTerm2). The vulnerability triggers entirely on the server side by writing bytes to the pty — no desktop environment is required on the server; a standard SSH session to the affected server is sufficient for the payload to reach the victim's local terminal.

Impact

Local privilege escalation chain: any local unprivileged user can inject terminal escape sequences into the terminals of all logged-in users (including root) on distributions that package wall(1)/write(1) setgid-tty (Debian, Ubuntu 22.04 per the original report; verify with "ls -l /usr/bin/wall /usr/bin/write"). Clipboard hijack + paste -> command execution as the victim; forged prompts -> credential theft.

The vulnerable code is present in: bsdutils (wall) and bsdextrautils (write) on Debian/Ubuntu/Mint (util-linux source); util-linux on Fedora/Arch. Exploitability depends on packaging: setgid-tty builds (Debian, Ubuntu) are exploitable by any local user; mode-0755 builds (e.g. Linux Mint, CentOS) are not exploitable by unprivileged attackers (non-root senders cannot write other users' ttys), though the vulnerable code is present.