CVE-2023-24626: Medium severity suse screen vulnerability

Q: What is CVE-2023-24626?

CVE-2023-24626 is a vulnerability in GNU Screen through version 4.9.0 that allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.

Q: How does CVE-2023-24626 affect GNU Screen?

CVE-2023-24626 affects GNU Screen through version 4.9.0 when it is installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD).

Q: What is the severity of CVE-2023-24626?

CVE-2023-24626 has a severity rating of 6.5 (medium).

Q: How can CVE-2023-24626 be exploited?

CVE-2023-24626 can be exploited by local users sending a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.

Q: Can CVE-2023-24626 be fixed?

Yes, CVE-2023-24626 can be fixed by updating GNU Screen to a version beyond 4.9.0.

Published Apr 8, 2023

Updated

socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.

Affected Software

1 affected component

GNU Screen<=4.9.0

Remediation

Patch Available

https://git.savannah.gnu.org/cgit/screen.git/patch/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7

Event History

Apr 8, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-24626?

CVE-2023-24626 is a vulnerability in GNU Screen through version 4.9.0 that allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.

How does CVE-2023-24626 affect GNU Screen?