Glonce

Decade-old OpenSSH and musl flaw lets attackers SSH into Alpine Linux without a password

securityThe Glonce editorsArs Technica🔥60Glonce rating60Impact55Novelty60Relevance70Surprise60Players10Credibility80
Decade-old OpenSSH and musl flaw lets attackers SSH into Alpine Linux without a password

Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that lets attackers log in with no password, Ars Technica reports.

The flaw sits in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library. Unlike most other Linux distributions, Alpine uses musl. Alpine is a lightweight, widely used Linux distribution. The OpenSSH build must also not use PAM (pluggable authentication modules), the framework that handles user authentication and account-access checks. Other platforms may be affected if they use the same configurations.

Two more conditions have to hold. First, the system must have at least one user account that is accessible using a password hashed with the SHA256 or SHA512 functions. Second, the target account must be passwordless, set by specifying a "*" in the password field of /etc/shadow, the Linux file where password hashes are stored. Passwordless accounts are commonly used for accounts that use certificate-based authentication, and the setting is common for certain types of accounts.

When all the conditions are met, the attacker logs into the passwordless account by entering more than 256 characters in the password field. Alpine maintainers, who described the problem on Thursday, said: "An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries."

Security firm Checkpoint added detail. It said the SHA256 or SHA512 requirement "matters because sshd borrows that account's salt. Without it, the attack fails." Its researchers also found in testing that the account must be active, not just hold a hash. Checkpoint further reported that root accounts are safe under the default PermitRootLogin prohibit password setting, though reachable accounts with doas or sudo rights can still become root.

Key facts

  • A decade-old flaw in the interaction between OpenSSH and musl lets attackers log into some Alpine Linux devices without a password; other distributions may also be affected.
  • Exploitation requires OpenSSH with musl and without PAM, a SHA256 or SHA512 hashed password on at least one account, and a target account set passwordless with "*" in /etc/shadow.
  • The attacker enters more than 256 characters in the password field of the passwordless account; Alpine maintainers say it takes one connection and no retries.
  • Checkpoint found the target account must be active, not just hold a hash; root is safe under the default PermitRootLogin prohibit password setting, but reachable accounts with doas or sudo rights can still become root.

Why it matters

SSH is the main way many Linux machines are reached remotely, and this flaw removes the password check for a certain kind of account. Alpine maintainers say the attacker only needs to reach the SSH port, and the attack takes one connection, works every time and needs no retries. The bug is also old: it is described as decade-old.

Who it affects

Devices running some configurations of Alpine Linux, a lightweight and widely used distribution that, unlike most others, uses musl. Ars Technica says other distributions and platforms may be affected if they use the same configurations, but the text does not name any. Systems with passwordless accounts for certificate-based authentication are the natural fit for the conditions, since such accounts commonly use the "*" setting.

How to use it

This is a vulnerability report, not a tool, but the conditions give a checklist for exposure. A system is in scope if OpenSSH runs with musl and without PAM, if at least one account uses a SHA256 or SHA512 password hash, and if a target account is active and passwordless with "*" in the password field of /etc/shadow. Checkpoint notes that root is safe under the default PermitRootLogin prohibit password setting, while reachable accounts with doas or sudo rights can still become root. No patch, fixed version or mitigation is described in the source.

How solid is it

The claims come from Ars Technica's report, which quotes Alpine maintainers directly and cites Checkpoint researchers who tested the attack and reported on its conditions. The two accounts fit together: Checkpoint's findings on salt and active accounts narrow the conditions the maintainers' statement describes. No CVE identifier, CVSS score or severity rating is given, and no named discoverer.

Risks and caveats

The attack only works when every condition is met, so many Alpine systems may not be exposed. The reverse risk is that the set of other affected distributions is unknown, since the text says only "possibly other distributions". Passwordless accounts with doas or sudo rights are a path to root even though root itself is safe by default. No evidence of exploitation in the wild is mentioned.

“An attacker who can reach your SSH port can log in without knowing any password”

— Alpine maintainers