!39 [sync] PR-36: fix CVE-2025-46802, CVE-2025-46804, CVE-2025-46805

From: @openeuler-sync-bot 
Reviewed-by: @dillon_chen 
Signed-off-by: @dillon_chen

backport-CVE-2021-26937.patch

@@ -1,61 +0,0 @@
-Description: [CVE-2021-26937] Fix out of bounds array access
-Author: Michael Schröder <mls@suse.de>
-Bug-Debian: https://bugs.debian.org/982435
-Bug: https://savannah.gnu.org/bugs/?60030
-Bug: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
-Bug-OSS-Security: https://www.openwall.com/lists/oss-security/2021/02/09/3
-Origin: https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00010.html
-
---- a/encoding.c
-+++ b/encoding.c
-@@ -43,7 +43,7 @@
- # ifdef UTF8
- static int   recode_char __P((int, int, int));
- static int   recode_char_to_encoding __P((int, int));
--static void  comb_tofront __P((int, int));
-+static void  comb_tofront __P((int));
- #  ifdef DW_CHARS
- static int   recode_char_dw __P((int, int *, int, int));
- static int   recode_char_dw_to_encoding __P((int, int *, int));
-@@ -1093,15 +1093,18 @@
-     { 0xE0100, 0xE01EF }
-   };
- 
-+  if (c >= 0xdf00 && c <= 0xdfff)
-+    return 1;          /* dw combining sequence */
-   return bisearch(c, combining, sizeof(combining) / sizeof(struct interval) - 1);
- }
- 
- static void
--comb_tofront(root, i)
--int root, i;
-+comb_tofront(i)
-+int i;
- {
-   for (;;)
-     {
-+      int root = i >= 0x700 ? 0x801 : 0x800;
-       debug1("bring to front: %x\n", i);
-       combchars[combchars[i]->prev]->next = combchars[i]->next;
-       combchars[combchars[i]->next]->prev = combchars[i]->prev;
-@@ -1163,9 +1166,9 @@
-     {
-       /* full, recycle old entry */
-       if (c1 >= 0xd800 && c1 < 0xe000)
--        comb_tofront(root, c1 - 0xd800);
-+        comb_tofront(c1 - 0xd800);
-       i = combchars[root]->prev;
--      if (c1 == i + 0xd800)
-+      if (i == 0x800 || i == 0x801 || c1 == i + 0xd800)
- 	{
- 	  /* completely full, can't recycle */
- 	  debug("utf8_handle_comp: completely full!\n");
-@@ -1189,7 +1192,7 @@
-   mc->font  = (i >> 8) + 0xd8;
-   mc->fontx = 0;
-   debug3("combinig char %x %x -> %x\n", c1, c, i + 0xd800);
--  comb_tofront(root, i);
-+  comb_tofront(i);
- }
- 
- #else /* !UTF8 */

backport-CVE-2023-24626.patch

@@ -0,0 +1,43 @@
+From 6df4a48ff6b31bedc2d0216b84dbe66cf9ca5e23 Mon Sep 17 00:00:00 2001
+From: Alexander Naumov <alexander_naumov@opensuse.org>
+Date: Wed, 1 Feb 2023 13:47:57 +0200
+Subject: [PATCH] Missing signal sending permission check on failed query
+ messages
+
+When run as setuid root, one can send a query message to the
+privileged screen process via its unix socket in order to force
+it to send SIGHUP to a PID that can be freely specified in the
+query packet.
+Processes that do not explicitly handle SIGHUP will simply terminate
+
+Signed-off-by: Alexander Naumov <alexander_naumov@opensuse.org>
+---
+ socket.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/socket.c b/socket.c
+index bb68b35..0a575cf 100644
+--- a/socket.c
++++ b/socket.c
+@@ -1285,11 +1285,16 @@ ReceiveMsg()
+           else
+             queryflag = -1;
+ 
+-          Kill(m.m.command.apid,
++	  if (CheckPid(m.m.command.apid)) {
++	    Msg(0, "Query attempt with bad pid(%d)!", m.m.command.apid);
++	  }
++	  else {
++            Kill(m.m.command.apid,
+                (queryflag >= 0)
+                    ? SIGCONT
+                    : SIG_BYE); /* Send SIG_BYE if an error happened */
+-          queryflag = -1;
++            queryflag = -1;
++	  }
+         }
+         break;
+       case MSG_COMMAND:
+-- 
+2.27.0
+

backport-CVE-2025-46802.patch

@@ -0,0 +1,140 @@
+From 049b26b22e197ba3be9c46e5c193032e01a4724a Mon Sep 17 00:00:00 2001
+From: Matthias Gerstner <matthias.gerstner@suse.de>
+Date: Mon, 12 May 2025 15:15:38 +0200
+Subject: [PATCH 1/3] fix CVE-2025-46802: attacher.c - prevent temporary 0666
+ mode on PTYs
+
+This temporary chmod of the PTY to mode 0666 is most likely a remnant of
+past times, before the PTY file descriptor was passed to the target
+session via the UNIX domain socket.
+
+This chmod() causes a race condition during which any other user in the
+system can open the PTY for reading and writing, and thus allows PTY
+hijacking.
+
+Simply remove this logic completely.
+---
+ attacher.c | 27 ---------------------------
+ screen.c   | 19 -------------------
+ 2 files changed, 46 deletions(-)
+
+diff --git a/attacher.c b/attacher.c
+index c35ae7a..16b151e 100644
+--- a/attacher.c
++++ b/attacher.c
+@@ -73,7 +73,6 @@ extern int MasterPid, attach_fd;
+ #ifdef MULTIUSER
+ extern char *multi;
+ extern int multiattach, multi_uid, own_uid;
+-extern int tty_mode, tty_oldmode;
+ # ifndef USE_SETEUID
+ static int multipipe[2];
+ # endif
+@@ -160,9 +159,6 @@ int how;
+ 
+       if (pipe(multipipe))
+ 	Panic(errno, "pipe");
+-      if (chmod(attach_tty, 0666))
+-	Panic(errno, "chmod %s", attach_tty);
+-      tty_oldmode = tty_mode;
+       eff_uid = -1;	/* make UserContext fork */
+       real_uid = multi_uid;
+       if ((ret = UserContext()) <= 0)
+@@ -174,11 +170,6 @@ int how;
+ 	    Panic(errno, "UserContext");
+ 	  close(multipipe[1]);
+ 	  read(multipipe[0], &dummy, 1);
+-	  if (tty_oldmode >= 0)
+-	    {
+-	      chmod(attach_tty, tty_oldmode);
+-	      tty_oldmode = -1;
+-	    }
+ 	  ret = UserStatus();
+ #ifdef LOCK
+ 	  if (ret == SIG_LOCK)
+@@ -224,9 +215,6 @@ int how;
+       xseteuid(multi_uid);
+       xseteuid(own_uid);
+ #endif
+-      if (chmod(attach_tty, 0666))
+-	Panic(errno, "chmod %s", attach_tty);
+-      tty_oldmode = tty_mode;
+     }
+ # endif /* USE_SETEUID */
+ #endif /* MULTIUSER */
+@@ -423,13 +411,6 @@ int how;
+       ContinuePlease = 0;
+ # ifndef USE_SETEUID
+       close(multipipe[1]);
+-# else
+-      xseteuid(own_uid);
+-      if (tty_oldmode >= 0)
+-        if (chmod(attach_tty, tty_oldmode))
+-          Panic(errno, "chmod %s", attach_tty);
+-      tty_oldmode = -1;
+-      xseteuid(real_uid);
+ # endif
+     }
+ #endif
+@@ -505,14 +486,6 @@ AttacherFinit SIGDEFARG
+ 	  close(s);
+ 	}
+     }
+-#ifdef MULTIUSER
+-  if (tty_oldmode >= 0)
+-    {
+-      if (setuid(own_uid))
+-        Panic(errno, "setuid");
+-      chmod(attach_tty, tty_oldmode);
+-    }
+-#endif
+   exit(0);
+   SIGRETURN;
+ }
+diff --git a/screen.c b/screen.c
+index 7653cd1..1a23e1a 100644
+--- a/screen.c
++++ b/screen.c
+@@ -230,8 +230,6 @@ char *multi_home;
+ int multi_uid;
+ int own_uid;
+ int multiattach;
+-int tty_mode;
+-int tty_oldmode = -1;
+ #endif
+ 
+ char HostName[MAXSTR];
+@@ -1009,9 +1007,6 @@ int main(int ac, char** av)
+ 
+     /* ttyname implies isatty */
+     SetTtyname(true, &st);
+-#ifdef MULTIUSER
+-    tty_mode = (int)st.st_mode & 0777;
+-#endif
+ 
+     fl = fcntl(0, F_GETFL, 0);
+     if (fl != -1 && (fl & (O_RDWR|O_RDONLY|O_WRONLY)) == O_RDWR)
+@@ -2170,20 +2165,6 @@ DEFINE_VARARGS_FN(Panic)
+       if (D_userpid)
+         Kill(D_userpid, SIG_BYE);
+     }
+-#ifdef MULTIUSER
+-  if (tty_oldmode >= 0) {
+-
+-# ifdef USE_SETEUID
+-    if (setuid(own_uid))
+-      xseteuid(own_uid);	/* may be a loop. sigh. */
+-# else
+-      setuid(own_uid);
+-# endif
+-
+-    debug1("Panic: changing back modes from %s\n", attach_tty);
+-    chmod(attach_tty, tty_oldmode);
+-  }
+-#endif
+   eexit(1);
+ }
+ 
+-- 
+2.43.5
+

backport-CVE-2025-46804.patch

@@ -0,0 +1,125 @@
+From e0eef5aac453fa98a2664416a56c50ad1d00cb30 Mon Sep 17 00:00:00 2001
+From: Matthias Gerstner <matthias.gerstner@suse.de>
+Date: Mon, 12 May 2025 15:26:11 +0200
+Subject: [PATCH 2/3] fix CVE-2025-46804: avoid file existence test information
+ leaks
+
+In setuid-root context the current error messages give away whether
+certain paths not accessible by the real user exist and what type they
+have. To prevent this only output generic error messages in setuid-root
+context.
+
+In some situations, when an error is pertaining a directory and the
+directory is owner by the real user then we can still output more
+detailed diagnostics.
+
+This change can lead to less helpful error messages when Screen is
+install setuid-root. More complex changes would be needed to avoid this
+(e.g.  only open the `SocketPath` with raised privileges when
+multi-attach is requested).
+
+There might still be lingering some code paths that allow such
+information leaks, since `SocketPath` is a global variable that is used
+across the code base. The majority of issues should be caught with this
+fix, however.
+---
+ screen.c | 45 ++++++++++++++++++++++++++++++++++-----------
+ socket.c |  9 +++++++--
+ 2 files changed, 41 insertions(+), 13 deletions(-)
+
+diff --git a/screen.c b/screen.c
+index 1a23e1a..6eec151 100644
+--- a/screen.c
++++ b/screen.c
+@@ -1122,15 +1122,28 @@ int main(int ac, char** av)
+ #endif
+   }
+ 
+-  if (stat(SockPath, &st) == -1)
+-    Panic(errno, "Cannot access %s", SockPath);
+-  else
+-    if (!S_ISDIR(st.st_mode))
++  if (stat(SockPath, &st) == -1) {
++    if (eff_uid == real_uid) {
++      Panic(errno, "Cannot access %s", SockPath);
++    } else {
++      Panic(0, "Error accessing %s", SockPath);
++    }
++  } else if (!S_ISDIR(st.st_mode)) {
++    if (eff_uid == real_uid || st.st_uid == real_uid) {
+       Panic(0, "%s is not a directory.", SockPath);
++    } else {
++      Panic(0, "Error accessing %s", SockPath);
++    }
++  }
+ #ifdef MULTIUSER
+   if (multi) {
+-    if ((int)st.st_uid != multi_uid)
+-      Panic(0, "%s is not the owner of %s.", multi, SockPath);
++    if ((int)st.st_uid != multi_uid) {
++      if (eff_uid == real_uid || st.st_uid == real_uid) {
++        Panic(0, "%s is not the owner of %s.", multi, SockPath);
++      } else {
++        Panic(0, "Error accessing %s", SockPath);
++      }
++    }
+   }
+   else
+ #endif
+@@ -1144,9 +1157,13 @@ int main(int ac, char** av)
+       Panic(0, "You are not the owner of %s.", SockPath);
+ #endif
+   }
+-
+-  if ((st.st_mode & 0777) != 0700)
+-    Panic(0, "Directory %s must have mode 700.", SockPath);
++  if ((st.st_mode & 0777) != 0700) {
++    if (eff_uid == real_uid || st.st_uid == real_uid) {
++      Panic(0, "Directory %s must have mode 700.", SockPath);
++    } else {
++      Panic(0, "Error accessing %s", SockPath);
++    }
++  }
+   if (SockMatch && index(SockMatch, '/'))
+     Panic(0, "Bad session name '%s'", SockMatch);
+   SockName = SockPath + strlen(SockPath) + 1;
+@@ -1184,8 +1201,14 @@ int main(int ac, char** av)
+       else
+         exit(9 + (fo || oth ? 1 : 0) + fo);
+     }
+-    if (fo == 0)
+-      Panic(0, "No Sockets found in %s.\n", SockPath);
++    if (fo == 0) {
++      if (eff_uid == real_uid || st.st_uid == real_uid) {
++        Panic(0, "No Sockets found in %s.\n", SockPath);
++      } else {
++        Panic(0, "Error accessing %s", SockPath);
++      }
++    }
++
+     Msg(0, "%d Socket%s in %s.", fo, fo > 1 ? "s" : "", SockPath);
+     eexit(0);
+   }
+diff --git a/socket.c b/socket.c
+index 54d8cb8..6c3502f 100644
+--- a/socket.c
++++ b/socket.c
+@@ -169,8 +169,13 @@ bool *is_sock;
+   xsetegid(real_gid);
+ #endif
+ 
+-  if ((dirp = opendir(SockPath)) == 0)
+-    Panic(errno, "Cannot opendir %s", SockPath);
++  if ((dirp = opendir(SockPath)) == 0) {
++    if (eff_uid == real_uid) {
++      Panic(errno, "Cannot opendir %s", SockPath);
++    } else {
++      Panic(0, "Error accessing %s", SockPath);
++    }
++  }
+ 
+   slist = 0;
+   slisttail = &slist;
+-- 
+2.43.5
+

backport-CVE-2025-46805.patch

@@ -0,0 +1,114 @@
+From 161f85b98b7e1d5e4893aeed20f4cdb5e3dfaaa4 Mon Sep 17 00:00:00 2001
+From: Matthias Gerstner <matthias.gerstner@suse.de>
+Date: Mon, 12 May 2025 15:38:19 +0200
+Subject: [PATCH 3/3] fix CVE-2025-46805: socket.c - don't send signals with
+ root privileges
+
+The CheckPid() function was introduced to address CVE-2023-24626, to
+prevent sending SIGCONT and SIGHUP to arbitrary PIDs in the system. This
+fix still suffers from a TOCTOU race condition. The client can replace
+itself by a privileged process, or try to cycle PIDs until a privileged
+process receives the original PID.
+
+To prevent this, always send signals using the real privileges. Keep
+CheckPid() for error diagnostics. If sending the actual signal fails
+later on then there will be no more error reporting.
+
+It seems the original bugfix already introduced a regression when
+attaching to another's user session that is not owned by root. In this
+case the target sessions runs with real uid X, while for sending a
+signal to the `pid` provided by the client real uid Y (or root
+privileges) are required.
+
+This is hard to properly fix without this regression. On Linux pidfds
+could be used to allow safely sending signals to other PIDs as root
+without involving race conditions. In this case the client PID should
+also be obtained via the UNIX domain socket's SO_PEERCRED option,
+though.
+---
+ socket.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/socket.c b/socket.c
+index 6c3502f..d6621fa 100644
+--- a/socket.c
++++ b/socket.c
+@@ -831,6 +831,11 @@ int pid;
+   return UserStatus();
+ }
+ 
++static void KillUnpriv(pid_t pid, int sig) {
++    UserContext();
++    UserReturn(kill(pid, sig));
++}
++
+ #ifdef hpux
+ /*
+  * From: "F. K. Bruner" <napalm@ugcs.caltech.edu>
+@@ -916,14 +921,14 @@ struct win *wi;
+             {
+ 	      Msg(errno, "Could not perform necessary sanity checks on pts device.");
+ 	      close(i);
+-	      Kill(pid, SIG_BYE);
++	      KillUnpriv(pid, SIG_BYE);
+ 	      return -1;
+             }
+           if (strcmp(ttyname_in_ns, m->m_tty))
+             {
+ 	      Msg(errno, "Attach: passed fd does not match tty: %s - %s!", ttyname_in_ns, m->m_tty[0] != '\0' ? m->m_tty : "(null)");
+ 	      close(i);
+-	      Kill(pid, SIG_BYE);
++	      KillUnpriv(pid, SIG_BYE);
+ 	      return -1;
+ 	    }
+ 	  /* m->m_tty so far contains the actual name of the pts device in the
+@@ -940,19 +945,19 @@ struct win *wi;
+ 	{
+ 	  Msg(errno, "Attach: passed fd does not match tty: %s - %s!", m->m_tty, myttyname ? myttyname : "NULL");
+ 	  close(i);
+-	  Kill(pid, SIG_BYE);
++	  KillUnpriv(pid, SIG_BYE);
+ 	  return -1;
+ 	}
+     }
+   else if ((i = secopen(m->m_tty, O_RDWR | O_NONBLOCK, 0)) < 0)
+     {
+       Msg(errno, "Attach: Could not open %s!", m->m_tty);
+-      Kill(pid, SIG_BYE);
++      KillUnpriv(pid, SIG_BYE);
+       return -1;
+     }
+ #ifdef MULTIUSER
+   if (attach)
+-    Kill(pid, SIGCONT);
++    KillUnpriv(pid, SIGCONT);
+ #endif
+ 
+ #if defined(ultrix) || defined(pyr) || defined(NeXT)
+@@ -965,7 +970,7 @@ struct win *wi;
+ 	{
+ 	  write(i, "Attaching from inside of screen?\n", 33);
+ 	  close(i);
+-	  Kill(pid, SIG_BYE);
++	  KillUnpriv(pid, SIG_BYE);
+ 	  Msg(0, "Attach msg ignored: coming from inside.");
+ 	  return -1;
+ 	}
+@@ -976,7 +981,7 @@ struct win *wi;
+ 	  {
+ 	      write(i, "Access to session denied.\n", 26);
+ 	      close(i);
+-	      Kill(pid, SIG_BYE);
++	      KillUnpriv(pid, SIG_BYE);
+ 	      Msg(0, "Attach: access denied for user %s.", user);
+ 	      return -1;
+ 	  }
+@@ -1294,7 +1299,7 @@ ReceiveMsg()
+ 	    Msg(0, "Query attempt with bad pid(%d)!", m.m.command.apid);
+ 	  }
+ 	  else {
+-            Kill(m.m.command.apid,
++            KillUnpriv(m.m.command.apid,
+                (queryflag >= 0)
+                    ? SIGCONT
+                    : SIG_BYE); /* Send SIG_BYE if an error happened */

screen.spec

@@ -1,7 +1,7 @@
 Name:           screen
 Epoch:          1
-Version:        4.8.0
+Version:        4.9.0
-Release:        9
+Release:        3
 Summary:        A full-screen window manager
 License:        GPLv3+
 URL:            http://www.gnu.org/software/screen
@@ -12,9 +12,14 @@ Patch1:         screen-4.3.1-screenrc.patch
 Patch2:         screen-E3.patch
 Patch3:         screen-4.3.1-suppress_remap.patch
 Patch4:         screen-4.3.1-crypt.patch
-Patch5:		backport-CVE-2021-26937.patch
+
+Patch6001:      backport-CVE-2023-24626.patch
+Patch6002:      backport-CVE-2025-46802.patch
+Patch6003:      backport-CVE-2025-46804.patch
+Patch6004:      backport-CVE-2025-46805.patch
 
 BuildRequires:  automake autoconf gcc ncurses-devel texinfo
+BuildRequires:  systemd
 Requires:       shadow-utils
 Requires(preun): info
 Requires(post):  info
@@ -42,7 +47,6 @@ autoreconf -fiv
 	--enable-colors256 \
 	--enable-rxvt_osc \
 	--enable-use-locale \
-	--enable-telnet \
 	--with-pty-mode=0620 \
 	--with-sys-screenrc="%{_sysconfdir}/screenrc" \
 	--with-socket-dir="%{_rundir}/screen"
@@ -98,6 +102,22 @@ fi
 %{_infodir}/screen.info*
 
 %changelog
+* Tue May 13 2025 Funda Wang <fundawang@yeah.net> - 1:4.9.0-3
+- fix CVE-2025-46802, CVE-2025-46804, CVE-2025-46805
+
+* Wed Apr 19 2023 hongjinghao <hongjinghao@huawei.com> - 1:4.9.0-2
+- fix CVE-2023-24626
+
+* Fri Oct 21 2022 hongjinghao <hongjinghao@huawei.com> - 1:4.9.0-1
+- update to 4.9.0
+
+* Sat Jun 19 2021 panxiaohe <panxiaohe@huawei.com> - 1:4.8.0-11
+- remove '--enable-telnet' in configure
+
+* Fri Jun 4 2021 panxiaohe <panxiaohe@huawei.com> - 1:4.8.0-10
+- add systemd to BuildRequires to use _tmpfilesdir macro
+- fix bogus dates in changelog
+
 * Fri Feb 26 2021 lirui<lirui130@huawei.com> - 1:4.8.0-9
 - Type:bugfix
 - ID:NA
@@ -110,7 +130,7 @@ fi
 - SUG:NA
 - DESC:modify release and changelog
 
-* Tue Jul 16 2020 linwei<linwei54@huawei.com> - 1:4.8.0-7
+* Thu Jul 16 2020 linwei<linwei54@huawei.com> - 1:4.8.0-7
 - Type:enhancement
 - ID:NA
 - SUG:NA
@@ -134,10 +154,10 @@ fi
 - SUG:NA
 - DESC:add build requires of texinfo to solve the problem of build
 
-* Tue Sep 26 2019 openEuler Buildteam <buildteam@openeuler.org> - 1:4.6.2-3
+* Thu Sep 26 2019 openEuler Buildteam <buildteam@openeuler.org> - 1:4.6.2-3
 - Modify requires
 
-* Tue Sep 26 2019 openEuler Buildteam <buildteam@openeuler.org> - 1:4.6.2-2
+* Thu Sep 26 2019 openEuler Buildteam <buildteam@openeuler.org> - 1:4.6.2-2
 - Adjust requires
 
 * Sat Sep 7 2019 openEuler Buildteam <buildteam@openeuler.org> - 1:4.6.2-1