CVE-2018-20839
Description
The issue arises from the way systemd handles user passwords during the boot process. Specifically, passwords entered on the console during the system boot (e.g., for unlocking encrypted disks or logging in) could be logged in plaintext if certain conditions are met.
Statement
This vulnerability is rated as moderate rather than important because its exploitation requires specific local conditions that limit its impact and accessibility. The issue arises only under scenarios where user home directories become inaccessible, causing the login process to expose password input on a virtual terminal (VT1). To exploit this, an attacker needs local physical access (AV:P) or authenticated remote access (such as through SSH) to the system, and direct user interaction is necessary (UI:R) to actively switch between virtual terminals using Ctrl+Alt+F1 and Ctrl+Alt+F2. Furthermore, the vulnerability is confined to compromising the confidentiality of password inputs (C:H), with no effect on the system's integrity (I:N) or availability (A:N). It does not grant elevated privileges, modify system state, or interfere with ongoing system operations. The combination of requiring physical proximity, specific environmental conditions, and manual toggling significantly reduces the likelihood and broader exploitability of this vulnerability, thus categorizing it as moderate severity rather than important.
Further complications occur in this issue: the initial fix provided by upstream introduced a regression and was reverted. In the process of managing a new fix, other contributory issues were reported against Xorg and Plymouth. Plymouth's issue was resolved. The ostensible fix versions of systemd (v243) and Plymouth (v0.9.4) are both fixed in RHEL-9, therefore RHEL-9 has been determined to be Not Affected by this flaw. Because of uncertainties and unknowns surrounding the purported fixes, the issue will not be corrected in RHEL-8.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | 4.3 | N/A |
| Attack Vector | Physical | Physical | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
This vulnerability is only exploitable by a local user with physical access to the computer (AV:P), or had privileges to login to a terminal (such as via ssh) to observe output. User interaction is required (toggling back and forth using switching hotkeys at a physical keyboard, UI:R) and there is only impact, in the context of systemd, to Confidentiality (C:H). Exploiting the vulnerability itself has no impact on Integrity (cannot be exploited to change anything, I:N) or to Availability (does not stop systemd from operating, A:N).
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
