• Bug#1105892: marked as done (unblock: screen/4.9.1-3) (2/2)

    From Debian Bug Tracking System@21:1/5 to All on Thu May 22 08:40:01 2025
    [continued from previous message]

    diff -Nru screen-4.9.1/debian/patches/fix-CVE-2025-46805-socket.c-don-t-send-signals-with-.patch screen-4.9.1/debian/patches/fix-CVE-2025-46805-socket.c-don-t-send-signals-with-.patch
    --- screen-4.9.1/debian/patches/fix-CVE-2025-46805-socket.c-don-t-send-signals-with-.patch 1970-01-01 01:00:00.000000000 +0100
    +++ screen-4.9.1/debian/patches/fix-CVE-2025-46805-socket.c-don-t-send-signals-with-.patch 2025-05-16 17:46:51.000000000 +0200
    @@ -0,0 +1,113 @@
    +From: Matthias Gerstner <[email protected]>
    +Date: Mon, 12 May 2025 15:38:19 +0200
    +Subject: fix CVE-2025-46805: socket.c - don't send signals with root
    + privileges
    +Origin: https://git.savannah.gnu.org/cgit/screen.git/commit/?id=161f85b98b7e1d5e4893aeed20f4cdb5e3dfaaa4
    +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-46805
    +
    +The CheckPid() function was introduced to address CVE-2023-24626, to
    +prevent sending SIGCONT and SIGHUP to arbitrary PIDs in the system. This
    +fix still suffers from a TOCTOU race condition. The client can replace
    +itself by a privileged process, or try to cycle PIDs until a privileged +process receives the original PID.
    +
    +To prevent this, always send signals using t