CVE-2025-23395: falha de alta gravidade em screen
Local root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit set
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.3epss 0.3%
Screen 5.0.0 when it runs with setuid-root privileges does not drop privileges while operating on a user supplied path. This allows unprivileged users to create files in arbitrary locations with `root` ownership, the invoking user's (real) group ownership and file mode 0644. All data written to the Screen PTY will be logged into this file, allowing to escalate to root privileges
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
screenCVEs relacionadas — screen
No mesmo produto, das mais perigosas para as menos.
CVE-2025-46803MEDIUMScreen creates by default world-writable PTYsEPSS 0.3%CVE-2025-46804LOWScreen 5.0.0 and older versions allow file existence tests when installed setuid-rootEPSS 0.2%CVE-2025-46805MEDIUMScreen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-rootEPSS 0.2%