Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Mar 2024 22:30:41 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: <oss-security@...ts.openwall.com>
Subject: Re: CVE-2024-28085: Escape sequence injection in
 util-linux wall

While looking through upstream git for a fix for this┬╣, I stumbled upon 
another write(1)/wall(1) control character injection vulnerability, 
introduced last year in util-linux v2.39.

The offending commits are:

* https://github.com/util-linux/util-linux/commit/8a7b8456d1dc0e7c
   ("write: correctly handle wide characters")
* https://github.com/util-linux/util-linux/commit/aa13246a1bf1be9e
   ("wall: use fputs_careful()")

The added comment says:

>The locale of the recipient is nominally unknown,
>but it's a solid bet that the encoding is compatible with the author's.

Alas the bet is not that solid when writer's locale encoding is 
controlled by an attacker.

We can exploit this against terminal emulators that recognize C1 control 
characters, such as Linux VTs or screen(1):

    $ printf '\302\23331mMOO\302\2330m\n' | LC_ALL=kk_KZ wall

I don't see any good way to fix this on the util-linux's side. It should 
be fixed on the terminal emulators' side by disabling C1 support.


┬╣ https://github.com/util-linux/util-linux/commit/404b0781f52f7c04
   ("wall: fix escape sequence Injection [CVE-2024-28085]")

-- 
Jakub Wilk

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.