CVE-2018-20839 — systemd 242 changes the VT1 mode upon a logout, which allows attackers to read c
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Published
2019-05-17T03:39:01.000Z
Last modified
2024-08-05T12:12:29.348Z
01What is this vulnerability?
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
02Affected products
| Vendor | Product | Versions |
|---|
| n | a / n/a | n/a |
03Active exploitation status
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
04Recommended remediation
- Patch to a fixed version listed in the vendor advisory (see references below).
- Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
- Hunt historical logs for exploitation indicators — see Detection signatures below.
05Technical details
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
06Detection signatures
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
07Related CVEs
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.
08Timeline
- Published: 2019-05-17T03:39:01.000Z
- Last modified: 2024-08-05T12:12:29.348Z
09References
- bugs.launchpad.net — https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993
- github.com — https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb32…
- github.com — https://github.com/systemd/systemd/pull/12378
- www.securityfocus.com — http://www.securityfocus.com/bid/108389
- security.netapp.com — https://security.netapp.com/advisory/ntap-20190530-0002/
- lists.apache.org — https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430…
Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →