VULNERABILITY INTELLIGENCE

CVE-2018-20839

CVSS score4.3 MEDIUM

EPSS probability2.48%

CISA KEVNot currently listed

Published2019-05-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

Primary references

cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
cve@mitre.org — Issue Tracking, Third Party Advisory
cve@mitre.org — Patch
cve@mitre.org — Issue Tracking, Patch
cve@mitre.org — Mailing List
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108 — Mailing List
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory