CVEvulnerability
CVE-2018-20839
4.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2019-05-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Description
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Affected configurations
• systemd project systemd 242
• netapp cn1610 firmware
• netapp snapprotect
• netapp solidfire \& hci management node
References
- http://www.securityfocus.com/bid/108389 Broken Link, Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993 Issue Tracking, Third Party Advisory
- https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f Patch
- https://github.com/systemd/systemd/pull/12378 Issue Tracking, Patch
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E Mailing List
- https://security.netapp.com/advisory/ntap-20190530-0002/ Third Party Advisory
- http://www.securityfocus.com/bid/108389 Broken Link, Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993 Issue Tracking, Third Party Advisory
- https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f Patch
- https://github.com/systemd/systemd/pull/12378 Issue Tracking, Patch
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E Mailing List
- https://security.netapp.com/advisory/ntap-20190530-0002/ Third Party Advisory