CVE-2018-20839

The issue arises from the way systemd handles user passwords during the boot process. Specifically, passwords entered on the console during the system boot (e.g., for unlocking encrypted disks or logging in) could be logged in plaintext if certain conditions are met.

This vulnerability is rated as moderate rather than important because its exploitation requires specific local conditions that limit its impact and accessibility. The issue arises only under scenarios where user home directories become inaccessible, causing the login process to expose password input on a virtual terminal (VT1). To exploit this, an attacker needs local physical access (AV:P) or authenticated remote access (such as through SSH) to the system, and direct user interaction is necessary (UI:R) to actively switch between virtual terminals using Ctrl+Alt+F1 and Ctrl+Alt+F2. Furthermore, the vulnerability is confined to compromising the confidentiality of password inputs (C:H), with no effect on the system's integrity (I:N) or availability (A:N). It does not grant elevated privileges, modify system state, or interfere with ongoing system operations. The combination of requiring physical proximity, specific environmental conditions, and manual toggling significantly reduces the likelihood and broader exploitability of this vulnerability, thus categorizing it as moderate severity rather than important.

Further complications occur in this issue: the initial fix provided by upstream introduced a regression and was reverted. In the process of managing a new fix, other contributory issues were reported against Xorg and Plymouth. Plymouth's issue was resolved. The ostensible fix versions of systemd (v243) and Plymouth (v0.9.4) are both fixed in RHEL-9, therefore RHEL-9 has been determined to be Not Affected by this flaw. Because of uncertainties and unknowns surrounding the purported fixes, the issue will not be corrected in RHEL-8.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.