Bug 2364199 (CVE-2025-46802)

Summary: CVE-2025-46802 screen: TTY Hijacking while Attaching to a Multiuser Session
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Screen, allowing TTY hijacking during attachment to a multiuser session. The issue with this temporary TTY mode change is that it introduces a race condition that allows any other user in the system to open the caller's TTY for reading and writing for a small period of time.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2368503, 2368504    
Bug Blocks:    

Description OSIDB Bzimport 2025-05-05 20:08:23 UTC 
This issue is found in the `Attach()` function when the `multiattach` flag is
set (i.e. Screen attempts to attach to a multiuser session). The function
performs a `chmod()` of the current TTY to mode 0666. The path to the current TTY is stored in the `attach_tty` string.