1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
Adapted from https://git.savannah.gnu.org/cgit/screen.git/patch/?id=e0eef5aac453fa98a2664416a56c50ad1d00cb30
From e0eef5aac453fa98a2664416a56c50ad1d00cb30 Mon Sep 17 00:00:00 2001
From: Matthias Gerstner <matthias.gerstner@suse.de>
Date: Mon, 12 May 2025 15:26:11 +0200
Subject: fix CVE-2025-46804: avoid file existence test information leaks
In setuid-root context the current error messages give away whether
certain paths not accessible by the real user exist and what type they
have. To prevent this only output generic error messages in setuid-root
context.
In some situations, when an error is pertaining a directory and the
directory is owner by the real user then we can still output more
detailed diagnostics.
This change can lead to less helpful error messages when Screen is
install setuid-root. More complex changes would be needed to avoid this
(e.g. only open the `SocketPath` with raised privileges when
multi-attach is requested).
There might still be lingering some code paths that allow such
information leaks, since `SocketPath` is a global variable that is used
across the code base. The majority of issues should be caught with this
fix, however.
---
screen.c | 45 ++++++++++++++++++++++++++++++++++-----------
socket.c | 9 +++++++--
2 files changed, 41 insertions(+), 13 deletions(-)
diff --git a/screen.c b/screen.c
index 1a23e1a..6eec151 100644
--- a/screen.c
+++ b/screen.c
@@ -1122,15 +1122,28 @@ int main(int ac, char** av)
#endif
}
- if (stat(SockPath, &st) == -1)
- Panic(errno, "Cannot access %s", SockPath);
- else
- if (!S_ISDIR(st.st_mode))
+ if (stat(SockPath, &st) == -1) {
+ if (eff_uid == real_uid) {
+ Panic(errno, "Cannot access %s", SockPath);
+ } else {
+ Panic(0, "Error accessing %s", SockPath);
+ }
+ } else if (!S_ISDIR(st.st_mode)) {
+ if (eff_uid == real_uid || st.st_uid == real_uid) {
Panic(0, "%s is not a directory.", SockPath);
+ } else {
+ Panic(0, "Error accessing %s", SockPath);
+ }
+ }
#ifdef MULTIUSER
if (multi) {
- if ((int)st.st_uid != multi_uid)
- Panic(0, "%s is not the owner of %s.", multi, SockPath);
+ if ((int)st.st_uid != multi_uid) {
+ if (eff_uid == real_uid || st.st_uid == real_uid) {
+ Panic(0, "%s is not the owner of %s.", multi, SockPath);
+ } else {
+ Panic(0, "Error accessing %s", SockPath);
+ }
+ }
}
else
#endif
@@ -1144,9 +1157,13 @@ int main(int ac, char** av)
Panic(0, "You are not the owner of %s.", SockPath);
#endif
}
-
- if ((st.st_mode & 0777) != 0700)
- Panic(0, "Directory %s must have mode 700.", SockPath);
+ if ((st.st_mode & 0777) != 0700) {
+ if (eff_uid == real_uid || st.st_uid == real_uid) {
+ Panic(0, "Directory %s must have mode 700.", SockPath);
+ } else {
+ Panic(0, "Error accessing %s", SockPath);
+ }
+ }
if (SockMatch && index(SockMatch, '/'))
Panic(0, "Bad session name '%s'", SockMatch);
SockName = SockPath + strlen(SockPath) + 1;
@@ -1184,8 +1201,14 @@ int main(int ac, char** av)
else
exit(9 + (fo || oth ? 1 : 0) + fo);
}
- if (fo == 0)
- Panic(0, "No Sockets found in %s.\n", SockPath);
+ if (fo == 0) {
+ if (eff_uid == real_uid || st.st_uid == real_uid) {
+ Panic(0, "No Sockets found in %s.\n", SockPath);
+ } else {
+ Panic(0, "Error accessing %s", SockPath);
+ }
+ }
+
Msg(0, "%d Socket%s in %s.", fo, fo > 1 ? "s" : "", SockPath);
eexit(0);
}
diff --git a/socket.c b/socket.c
index 54d8cb8..6c3502f 100644
--- a/socket.c
+++ b/socket.c
@@ -169,8 +169,13 @@ bool *is_sock;
xsetegid(real_gid);
#endif
- if ((dirp = opendir(SockPath)) == 0)
- Panic(errno, "Cannot opendir %s", SockPath);
+ if ((dirp = opendir(SockPath)) == 0) {
+ if (eff_uid == real_uid) {
+ Panic(errno, "Cannot opendir %s", SockPath);
+ } else {
+ Panic(0, "Error accessing %s", SockPath);
+ }
+ }
slist = 0;
slisttail = &slist;
--
cgit v1.1
|
