CVE-2018-20839

NameCVE-2018-20839
Descriptionsystemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs929116

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
systemd (PTS)jessie215-17+deb8u7vulnerable
jessie (security)215-17+deb8u13vulnerable
stretch232-25+deb9u12vulnerable
stretch (security)232-25+deb9u11vulnerable
buster241-7~deb10u2vulnerable
bullseye, sid244-3vulnerable
xorg-server (PTS)jessie (security), jessie2:1.16.4-1+deb8u2vulnerable
stretch2:1.19.2-1+deb9u5vulnerable
stretch (security)2:1.19.2-1+deb9u4vulnerable
buster2:1.20.4-1vulnerable
bullseye, sid2:1.20.6-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
systemdsource(unstable)(unfixed)low929116
xorg-serversource(unstable)(unfixed)

Notes

[buster] - systemd <no-dsa> (Minor issue)
[stretch] - systemd <no-dsa> (Minor issue)
[jessie] - systemd <no-dsa> (Not reproducible without Ubuntu-style persistant VT1 greeter; too invasive to fix)
[jessie] - xorg-server <postponed> (Minor issue, revisit when the situation is clarified)
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993
https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f
https://github.com/systemd/systemd/pull/12378
The fix introduced a regression, cf. https://bugs.debian.org/929229
Issue was originally fixed for unstable in 241-4 but was reverted in 241-5
https://gitlab.freedesktop.org/xorg/xserver/issues/857
Upstream from systemd claimed originally it's not an issue in systemd, but
might revisit. Furthermore the issue might be fixed in the xorg xserver.
Tentative merge request: https://gitlab.freedesktop.org/xorg/xserver/merge_requests/241
Further analysis on the problem: https://gitlab.freedesktop.org/xorg/xserver/issues/857#note_201402
plymouth fix: https://gitlab.freedesktop.org/plymouth/plymouth/commit/28ee4012c94b4045b97e5a2a66f66b7688b2dff3
The plymouth fix does not seem to be enough though, cf.
https://gitlab.freedesktop.org/xorg/xserver/issues/857#note_220255

Search for package or bug name: Reporting problems