CVE-2023-24626

socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
6.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
VendorProductVersion
gnuscreen
𝑥
≤ 4.9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
screen
bullseye
unimportant
bookworm
unimportant
sid
4.9.1-1
fixed
trixie
4.9.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
screen
oracular
not-affected
noble
not-affected
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
focal
needs-triage
bionic
Fixed 4.6.2-1ubuntu1.1+esm1
released
xenial
Fixed 4.3.1-2ubuntu0.1+esm1
released
trusty
Fixed 4.1.0~20120320gitdb59704-9ubuntu0.1~esm3
released
Common Weakness Enumeration
References
https://git.savannah.gnu.org/cgit/screen.git/patch/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7
https://savannah.gnu.org/bugs/?63195
https://www.exploit-db.com/exploits/51252
https://git.savannah.gnu.org/cgit/screen.git/patch/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7
https://savannah.gnu.org/bugs/?63195
https://security.netapp.com/advisory/ntap-20250509-0003/
https://www.exploit-db.com/exploits/51252
https://www.exploit-db.com/exploits/51252