CVE-2025-23395

Published: May 26, 2025Modified: Jun 17, 2026Deferred

7.3

Vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: meissner@suse.de (Secondary)

Description

Screen 5.0.0 when it runs with setuid-root privileges does not drop privileges while operating on a user supplied path. This allows unprivileged users to create files in arbitrary locations with `root` ownership, the invoking user's (real) group ownership and file mode 0644. All data written to the Screen PTY will be logged into this file, allowing to escalate to root privileges

Related CWEs

CWE-271

Privilege Dropping / Lowering Errors

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

References (3)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23395

Source: meissner@suse.de

https://www.openwall.com/lists/oss-security/2025/05/12/1

Source: meissner@suse.de

https://www.openwall.com/lists/oss-security/2025/05/12/1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.