CVE-2025-46802

A flaw was found in Screen, allowing TTY hijacking during attachment to a multiuser session. The issue with this temporary TTY mode change is that it introduces a race condition that allows any other user in the system to open the caller's TTY for reading and writing for a small period of time.

This vulnerability is an Important local privilege escalation vector rather than a mere moderate flaw due to its exploitation potential during the short-lived but dangerously permissive window created by chmod(attach_tty, 0666). Even though the exposure of the TTY permissions may appear transient, this window allows attackers with local access to reliably read and inject arbitrary data into the victim’s TTY, including sensitive inputs like passwords or session-specific commands. The race condition inherent in the Attach() function’s logic multiplies the risk since TTY access for the duration of this window can be repeatedly attempted and exploited with high success rates. Furthermore, this vulnerability bypasses the usual privilege separation model of multi-user systems by enabling an unprivileged attacker to subvert the victim’s TTY in ways that can directly compromise the user’s session integrity and lead to further exploitation, such as terminal escape attacks or sophisticated phishing scenarios.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.