CVE-2025-23395: Screen 5.0.0 Privilege Escalation Flaw

CVE-2025-23395 Overview

A local privilege escalation vulnerability exists in GNU Screen version 5.0.0 when running with setuid-root privileges. The application fails to properly drop privileges while operating on user-supplied paths, allowing unprivileged users to create files in arbitrary locations with root ownership. This vulnerability can be exploited to achieve full root privileges on affected systems.

Critical Impact

Unprivileged local users can escalate to root privileges by creating arbitrary files with root ownership and leveraging PTY logging functionality to write controlled data to sensitive system locations.

Affected Products

• GNU Screen version 5.0.0
• Systems running Screen 5.0.0 with setuid-root privileges enabled
• Linux distributions with setuid-root Screen installations

Discovery Timeline

• 2025-05-26 - CVE-2025-23395 published to NVD
• 2025-05-28 - Last updated in NVD database

Technical Details for CVE-2025-23395

Vulnerability Analysis

This vulnerability is classified as CWE-271 (Privilege Dropping / Lowering Errors), representing a failure to properly drop elevated privileges before performing operations on user-controlled input. When Screen 5.0.0 is installed with setuid-root privileges, it retains root permissions while processing user-supplied file paths for logging functionality.

The core issue stems from the PTY (pseudo-terminal) logging mechanism in Screen. When a user specifies a log file path, the application creates the file with root ownership, the invoking user's real group ownership, and file mode 0644. Because any data written to the Screen PTY is subsequently logged to this file, an attacker can write arbitrary content to files owned by root in sensitive system locations.

Root Cause

The vulnerability originates from improper privilege management in Screen's file creation routines. When handling the logging functionality, Screen fails to drop its elevated setuid-root privileges before accessing user-supplied paths. This violates the principle of least privilege and allows the setuid-root context to persist during file operations that should be performed with the user's actual privilege level.

The design flaw enables unprivileged users to:

1. Specify arbitrary file paths for log output
2. Have those files created with root ownership
3. Write controlled content via PTY input to root-owned files

Attack Vector

This is a local attack vector requiring authenticated access to the target system. An attacker with low-privilege local access can exploit this vulnerability without user interaction by:

1. Invoking Screen with the logging feature enabled, specifying a path to a sensitive system file (such as /etc/cron.d/ or similar privileged directories)
2. Creating a new file with root ownership at the specified location
3. Writing malicious content through the PTY interface that gets logged to the root-owned file
4. Triggering execution of the malicious content through system mechanisms (e.g., cron execution)

The attack does not require any special conditions beyond having a setuid-root Screen binary installed, which is a common configuration on many Linux distributions.

Detection Methods for CVE-2025-23395

Indicators of Compromise

• Unexpected files appearing in sensitive system directories (e.g., /etc/cron.d/, /etc/sudoers.d/) with root ownership but unusual group ownership matching non-privileged users
• Files in privileged locations with file mode 0644 created at times correlating with Screen process execution
• Unusual Screen process activity from non-privileged user accounts
• Audit logs showing Screen processes accessing paths outside normal user directories

Detection Strategies

• Monitor file creation events in privileged directories using auditd rules to detect files created with root ownership by non-root processes
• Implement file integrity monitoring (FIM) on critical system directories such as /etc/cron.d/, /etc/sudoers.d/, and /etc/profile.d/
• Deploy endpoint detection rules to alert on Screen processes creating files outside of user home directories
• Review system logs for patterns indicating privilege escalation attempts via Screen

Monitoring Recommendations

• Configure auditd to monitor setuid binary execution, particularly for Screen with parameters indicating log file paths
• Establish baseline behavior for Screen usage patterns and alert on anomalies
• Monitor for new scheduled tasks or configuration files appearing in system directories
• Implement real-time alerting for file creation in sensitive locations with mismatched ownership patterns

How to Mitigate CVE-2025-23395

Immediate Actions Required

• Remove setuid-root permissions from Screen 5.0.0 binary immediately using chmod u-s /usr/bin/screen
• Audit systems for unauthorized files created in privileged directories with suspicious ownership patterns
• Update to a patched version of Screen when available from your distribution vendor
• Restrict access to Screen binary to trusted users only until patching is complete

Patch Information

Consult your Linux distribution vendor for security updates addressing CVE-2025-23395. SUSE has published a bug report tracking this issue. The vulnerability affects Screen version 5.0.0 specifically when installed with setuid-root privileges.

For technical details, see the SUSE Bug Report CVE-2025-23395 and the OpenWall OSS-Security Discussion.

Workarounds

• Remove the setuid bit from the Screen binary: chmod u-s /usr/bin/screen (note: this may impact multi-user screen sharing functionality)
• Configure system policies to prevent Screen from writing to sensitive directories using mandatory access control frameworks like SELinux or AppArmor
• Implement file system restrictions using chattr on critical directories to prevent unauthorized file creation
• Deploy application whitelisting to control which users can execute the Screen binary

# Remove setuid-root from Screen binary
chmod u-s /usr/bin/screen

# Verify Screen permissions (should show no 's' in permissions)
ls -la /usr/bin/screen

# Optional: Restrict Screen execution to specific group
chown root:screenusers /usr/bin/screen
chmod 750 /usr/bin/screen