---
id: CVE-2024-28085
title: >-
  wall in util-linux through 2.40, often installed with setgid tty permissions,
  allows escape sequences to be sent to other users' terminals through argv
summary: >-
  wall in util-linux through 2.40, often installed with setgid tty permissions,
  allows escape sequences to be sent to other users' terminals through argv.
  (Specifically, escape sequences received from stdin are blocked, but escape
  sequence…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-08-26T20:25:25.196139Z'
exploitAvailable: true
published: '2024-03-27'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T00:40:25.607Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-28085'
references:
  - url: 'https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt'
  - url: >-
      https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq
  - url: 'https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/'
  - url: 'https://www.openwall.com/lists/oss-security/2024/03/27/5'
  - url: 'https://github.com/skyler-ferrante/CVE-2024-28085'
  - url: 'https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html'
    label: >-
      [debian-lts-announce] 20240407 [SECURITY] [DLA 3782-1] util-linux security
      update
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/28/1'
    label: >-
      [oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in
      util-linux wall
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/27/6'
    label: >-
      [oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in
      util-linux wall
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/27/9'
    label: >-
      [oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in
      util-linux wall
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/27/8'
    label: >-
      [oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in
      util-linux wall
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/27/7'
    label: >-
      [oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in
      util-linux wall
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/28/2'
    label: >-
      [oss-security] 20240328 Re: Re: CVE-2024-28085: Escape sequence injection
      in util-linux wall
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/28/3'
    label: >-
      [oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in
      util-linux wall
  - url: 'http://www.openwall.com/lists/oss-security/2024/03/27/5'
    label: >-
      [oss-security] 20240327 CVE-2024-28085: Escape sequence injection in
      util-linux wall
  - url: 'https://security.netapp.com/advisory/ntap-20240531-0003/'
tags:
  - cve.org
  - exploit-available
epss: 0.02242
epssPercentile: 0.82762
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/skyler-ferrante/CVE-2024-28085'
    - 'https://github.com/oditynet/sleepall'
  checkedAt: '2026-10-27T16:42:04.396Z'
ingestedAt: '2026-10-15T04:46:37.311Z'
---

## Overview

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.