Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 25 Jan 2017 07:23:03 +0100
From: Solar Designer <>
Subject: Re: CVE request: GNU screen escalation

On Tue, Jan 24, 2017 at 10:28:56PM +0100, Moritz Muehlenhoff wrote:
> please assign a CVE ID for this vulnerability in GNU screen:

Per oss-security list content guidelines:

"At least the most essential part of your message (e.g., vulnerability
detail and/or exploit) should be directly included in the message itself
(and in plain text), rather than only included by reference to an
external resource.  Posting links to relevant external resources as well
is acceptable, but posting only links is not.  Your message should remain
valuable even with all of the external resources gone."

let's be including the actual content in here, in addition to links.

The screen-devel above is:

From:	anonymous
Subject: 	[screen-devel] [bug #50142] root exploit 4.5.0
Date: 	Tue, 24 Jan 2017 19:05:10 +0000 (UTC)


                 Summary: root exploit 4.5.0
                 Project: GNU Screen
            Submitted by: None
            Submitted on: Tue 24 Jan 2017 07:05:09 PM UTC
                Category: Program Logic
                Severity: 3 - Normal
                Priority: 5 - Normal
                  Status: None
                 Privacy: Private
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
                 Release: None
           Fixed Release: None
         Planned Release: None
           Work Required: None



Commit f86a374 ("screen.c: adding permissions check for the logfile

The check opens the logfile with full root privileges. This allows us to
truncate any file or create a root-owned file with any contents in any
directory and can be easily exploited to full root access in several

> address@...den:~$ screen --version
> Screen version 4.05.00 (GNU) 10-Dec-16
> address@...den:~$ id
> uid=125(buczek) gid=125(buczek)
> address@...den:~$ cd /etc
> address@...den:/etc (master)$ screen -D -m -L bla.bla echo fail
> address@...den:/etc (master)$ ls -l bla.bla
> -rw-rw---- 1 root buczek 6 Jan 24 19:58 bla.bla
> address@...den:/etc (master)$ cat bla.bla
> fail
> address@...den:/etc (master)$ 

Donald Buczek <address@...den>

There are some follow-ups, notably Axel Beckert pointing out that the
issue appears to have been introduced on 2016-11-04 (not 2015-11-04):

> Commit f86a374 ("screen.c: adding permissions check for the logfile name",
> 2015-11-04)

There is no such commit id, neither in the master branch nor in the
screen-v4 branch.

I assume you meant one of these two commits instead:


The latter is the one included in Screen 4.5.0.

The commits add this code:

+              FILE *w_check;
+              if ((w_check = fopen(screenlogfile, "w")) == NULL)
+                Panic(0, "-L: logfile name access problem");
+              else
+                fclose(w_check);

apparently into command-line option parsing in main(), thus apparently
prior to dropping the privileges.  (I didn't review this in context.)

Last but not least, I hope distros don't install screen SUID root these
days.  If any distro does, this is yet another reminder to reconsider.

Some install it SGID utmp.  Some take it a step further - Owl and ALT
Linux install it SGID to group screen, which only grants the ability to
invoke utempter (SGID utmp) and tcp_chkpwd (SGID shadow).  Thus, it'd
take a vulnerability in those other tools to make much use of a screen
vulnerability.  Here's an excerpt from ALT Linux's spec file:

ln -f %_libexecdir/chkpwd/tcb_chkpwd %_libexecdir/screen/
ln -f %_libexecdir/utempter/utempter %_libexecdir/screen/

if [ $1 -eq 0 ]; then
rm -f %_libexecdir/screen/{tcb_chkpwd,utempter}

%triggerin -- pam_tcb >=
ln -f %_libexecdir/chkpwd/tcb_chkpwd %_libexecdir/screen/

%triggerin -- libutempter >= 1.0.6
ln -f %_libexecdir/utempter/utempter %_libexecdir/screen/

%attr(2711,root,screen) %_bindir/screen
%attr(710,root,screen) %dir %_libexecdir/screen
%attr(2711,root,shadow) %ghost %_libexecdir/screen/tcb_chkpwd
%attr(2711,root,utmp) %ghost %_libexecdir/screen/utempter
%attr(775,root,screen) %dir /var/run/screen/


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.