CVE-2018-20839
CVE-2018-20839 is a medium-severity vulnerability in Systemd Project Systemd with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 4.3)
- CVSS v2: 4.3
- EPSS exploit prediction: 2% (83rd percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Systemd Project Systemd
- Published:
- Last modified:
Description
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Frequently asked questions
- What is CVE-2018-20839?
- systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
- How severe is CVE-2018-20839?
- CVE-2018-20839 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2018-20839 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (83rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2018-20839?
- CVE-2018-20839 primarily affects Systemd Project Systemd. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2018-20839?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2018-20839 published?
- CVE-2018-20839 was published on 2019-05-17 and last updated on 2026-06-17.
References
- http://www.securityfocus.com/bid/108389
- https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993
- https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f
- https://github.com/systemd/systemd/pull/12378
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190530-0002/
Affected products (4)
- cpe:2.3:a:systemd_project:systemd:242:-:*:*:*:*:*:*
- cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
More vulnerabilities in Systemd Project Systemd
- CVE-2022-2526 — Critical (CVSS 9.8): A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and…
- CVE-2018-21029 — Critical (CVSS 9.8): systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name…
- CVE-2015-7510 — Critical (CVSS 9.8): Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
- CVE-2017-1000082 — Critical (CVSS 9.8): systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the…
- CVE-2018-15688 — High (CVSS 8.8): A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory…
- CVE-2023-26604 — High (CVSS 7.8): systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible…