CVE-2025-46802: Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-26 · updated 2026-06-17
Weakness: CWE-732

Description

For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.

Affected products

SUSE Linux Enterprise Desktop 15 SP6: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1
SUSE Linux Enterprise High Performance Computing 15 SP6: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1
SUSE Linux Enterprise Micro 5.3: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1
SUSE Linux Enterprise Micro 5.4: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1
SUSE Linux Enterprise Micro 5.5: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1
SUSE Linux Enterprise Module for Basesystem 15 SP6: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1
SUSE Linux Enterprise Server 15 SP6: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6: from ? before 4.6.2-150000.5.8.1 — fixed in 4.6.2-150000.5.8.1

How to fix

Upgrade to a fixed version: SUSE Linux Enterprise Desktop 15 SP6 4.6.2-150000.5.8.1; SUSE Linux Enterprise High Performance Computing 15 SP6 4.6.2-150000.5.8.1; SUSE Linux Enterprise Micro 5.3 4.6.2-150000.5.8.1; SUSE Linux Enterprise Micro 5.4 4.6.2-150000.5.8.1; SUSE Linux Enterprise Micro 5.5 4.6.2-150000.5.8.1; SUSE Linux Enterprise Module for Basesystem 15 SP6 4.6.2-150000.5.8.1; SUSE Linux Enterprise Server 15 SP6 4.6.2-150000.5.8.1; SUSE Linux Enterprise Server for SAP Applications 15 SP6 4.6.2-150000.5.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-46802 or the next vulnerability affects your stack