CVE-2023-24626

State: Published
Severity: 6.5 Medium
Published: Apr 8, 2023
Updated: May 9, 2025
Reserved: Jan 30, 2023

Description

socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://savannah.gnu.org/bugs/?63195
https://git.savannah.gnu.org/cgit/screen.git/patch/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7
https://www.exploit-db.com/exploits/51252
https://security.netapp.com/advisory/ntap-20250509-0003/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.