← Vulnerability feed

Vulnerability record · CVE-2018-20839 · published 17 May 2019

CVE-2018-20839: Systemd project systemd vulnerability

Systemd Project · Systemd

systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

4.3 CVSS 3.1 Medium EPSS 2.5% · top 15.9%
4.3CVSS 3.1 base score, v2 4.3
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
4Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/108389 Broken LinkThird Party AdvisoryVDB Entry
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993 Issue TrackingThird Party Advisory
https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f Patch
https://github.com/systemd/systemd/pull/12378 Issue TrackingPatch
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org% Mailing List
https://security.netapp.com/advisory/ntap-20190530-0002/ Third Party Advisory
http://www.securityfocus.com/bid/108389 Broken LinkThird Party AdvisoryVDB Entry
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993 Issue TrackingThird Party Advisory
https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f Patch
https://github.com/systemd/systemd/pull/12378 Issue TrackingPatch
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org% Mailing List
https://security.netapp.com/advisory/ntap-20190530-0002/ Third Party Advisory

Track CVE-2018-20839 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2022-0492Linux kernel cgroups v1 release_agent privilege escalation and container escapeThe Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be …KEVEPSS 5.5%analysed7.8CVE-2018-14634Linux kernel create_elf_tables() integer overflow privilege escalationAn integer overflow in the Linux kernel's create_elf_tables() function lets an unprivileged local user escalate privileges when a SUID or otherwise p…KEVEPSS 15%analysed7.0CVE-2016-5195Linux Kernel Dirty COW Race Condition Privilege EscalationA race condition in the Linux kernel's mm/gup.c mishandles copy-on-write, letting a local user write to read-only memory mappings. This breaks the re…KEVEPSS 84%analysed9.8CVE-2024-56171Xmlsoft libxml2 use after free vulnerabilitylibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. …EPSS 1.2%9.8CVE-2022-2526Systemd project systemd use after free vulnerabilityA use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'reso…EPSS 1.3%9.8CVE-2021-26987Vmware spring boot vulnerabilityElement Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability…EPSS 2.4%9.8CVE-2018-21029Systemd project systemd improper certificate validation vulnerabilitysystemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent,…EPSS 3.1%9.8CVE-2019-10126Linux kernel heap-based buffer overflow vulnerabilityA flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.…EPSS 6.8%

Source: NIST National Vulnerability Database (record CVE-2018-20839), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.