CVE-2025-23395: 
Linux Fedora vulnerability analysis and mitigation

Screen 5.0.0 contains a critical security vulnerability (CVE-2025-23395) discovered in early 2025. When running with setuid-root privileges, the logfile_reopen() function fails to drop privileges while operating on user-supplied paths. The vulnerability specifically impacts systems where Screen is installed with setuid-root privileges, such as Arch Linux and NetBSD (SUSE Bugzilla, NVD).

The vulnerability exists in the logfile_reopen() function when Screen runs with setuid-root privileges. The function fails to drop privileges while handling user-supplied paths, allowing unprivileged users to create files in arbitrary locations with root ownership, the invoking user's real group ownership, and file mode 0644. The issue was introduced through commit 441bca708bd which removed the lfsecreopen() function. The vulnerability has received a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, Wiz).

The vulnerability allows unprivileged users to create files in arbitrary locations with root ownership. All data written to the Screen PTY will be logged into this file, enabling privilege escalation to root. Attackers can exploit this by writing new configuration files for tools like sudo or by appending code to privileged shell scripts in system directories (SUSE Bugzilla, Wiz).

The issue has been addressed by reintroducing secure file handling during logfile reopen. Distributions are advised not to install Screen with setuid-root privileges. For systems that require multi-user functionality, it is recommended to offer this feature only in an opt-in fashion, such as allowing only members of a trusted group to run a multi-user version of Screen (Openwall, Wiz).

A comprehensive security audit by the SUSE Security Team uncovered this vulnerability, leading to immediate responses from affected distributions. The discovery has prompted discussions about the security implications of setuid-root privileges in Screen installations (Security Online).