Attackers can log into passwordless accounts, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name and a password between 257 and 1024 bytes.
OpenSSH, which considers the flaw critical, today released version 10.6p2 to block it. Alpine has released fixed packages for every version since version 3.16.
The attack works when the OpenSSH (sshd) server verifies passwords without the Pluggable Authentication Module (PAM) interface, password logins are enabled, and at least one other account on the machine has a password. Alpine’s openssh-server package is built without PAM and password logins are enabled by default.
The flaw comes from the way sshd works with musl, the C library that Alpine is built on. Non-Linux systems, Linux systems built on glibc, and systems that verify passwords via PAM are not affected, said Damien Miller of the OpenSSH project.
It asked anyone running an affected system to “set PasswordAuthentication=no or disable SSH IMMEDIATELY for these systems.” No attacks using the flaw have been reported.
Who is exposed
Alpine’s safety advisory lists four conditions. A server is exposed when all four are true:
- He manages the
openssh-serverpackage, which is built without PAM, or runsopenssh-server-pamwithUsePAM no. PasswordAuthenticationEastyeswhich is the OpenSSH default.- An account has
*as password field, which means no password is set. - At least one other local account has a password hash starting with
$5$Or$6$.
The attacker also needs the name of an account without a password. One account with a password is enough to expose all accounts without passwords. The attack succeeds on each attempt with a single connection, according to the advisory.
On Alpine, passwordless accounts include:
- keyed users only created with
adduserwithout password, or withusermod -p '*' - users who come from a directory service via musl-nscd, since they don’t have a phantom entry
rootwhich was shipped asroot:*in base image since around Alpine 3.16- THE
alpineuser in official cloud images built with tiny-cloud
The root is protected by default PermitRootLogin prohibit-password adjustment and is only accessible directly if PermitRootLogin yes is set. This protection is not useful if an exposed account can become root, for example via doas.
The small cloud images from 3.18.11 to 3.24.3 give the alpine user without password doas. They are secure at first startup but become open to attacks as soon as possible. $6$ A hash exists on the machine, for example after an administrator sets a console password. An attacker can then connect as alpine and use doas become root.
Containers that don’t run sshd, systems with PasswordAuthentication noand cloud images configured via cloud-init, which writes this setting, are not affected. Accounts locked with ! In /etc/shadow are not affected either, and neither are machines that have no accounts on them. $-style password hash.
The fault is not limited to Alpine. Özgün Kültekin of Wakefield, who reported this, cites OpenWrt, Buildroot and Yocto in his technical report as other Musl-based systems to check.
OpenWrt handles SSH with Dropbear by default, as its Dropbear documentation shows, and Kültekin claims that Dropbear is unaffected. On OpenWrt, the flaw only matters where an administrator has installed the OpenSSH server.
How to fix it
On Alpine, the fix is a package update followed by a reboot, because the package upgrade does not restart the running sshd:
- Update the packages:
apk upgrade -U -a - Restart the server:
rc-service sshd restart
Interim releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 already include the patched package. Branches 3.16 to 3.21 are past the end of their support but have also received fixed packages.
Cloud instances started from small cloud images older than these point releases still require the update or setting below.
If you’re building OpenSSH yourself, version 10.6p2 includes the change, as described in its release notes.
If you can’t update yet, disabling password logins also stops the attack. First make sure your SSH key connection is working and keep your current session open until a new connection is successful. Then set PasswordAuthentication nocheck the configuration with sshd -tand restart sshd.
The notice gives commands that add the parameter to a drop-down file in /etc/ssh/sshd_config.dwhat Alpine’s default configuration reads from version 3.19. They also change every PasswordAuthentication input line /etc/ssh/sshd_config Since yes has noincluding lines inside a Match block. After, sshd -T | grep -i passwordauthentication should print passwordauthentication no.
The review suggests looking into /var/log/messages for reading sshd lines Accepted password for an account that does not have a password, such as alpine, root or a key user only. On exposed machines, also check doas usage, recently created users, files and authorized keys.
“If you can’t rule out a connection, consider the machine compromised,” he says.
Why Long Passwords Work
Without PAM, sshd checks a password itself. He chops the attempt with crypt()the C library function that transforms a password into its stored form and compares the result with the stored field.
An account without a password only has * in this area. It’s too short to contain a salt, the random prefix of a hash, so sshd borrows the salt from another account that has a real hash.
For the $5$ And $6$ hash types, musl crypt() rejects passwords longer than 256 bytes and returns * to report the error. That * corresponds to that stored *so sshd accepts the connection. The upper end of the range corresponds to sshd’s limit of 1024 bytes per password.
This behavior comes from a change of Muslim on August 9, 2012, which caused the failure of a crypt() the call returns “an incomparable hash rather than NULL” because many programs did not check for failures. The 256 byte limit was implemented on August 29, 2012 to protect servers against denial of service attacks.
The salt borrowing comes from a July 15, 2016 change to OpenSSH that fixed CVE-2016-6210, a flaw that allowed attackers to know which usernames exist. Kültekin says the problem has existed since then.
The 10.6p2 code change forces sshd to refuse a match when the stored field is less than four characters. OpenSSH calls this a workaround and claims the root cause lies outside of sshd. The stable Alpine packages contain a fix for the same issue.
Why the fix arrived the next day
Miller’s team discovered the flaw earlier this week and shipped the fix as quickly as possible. In the release announcement, he said the team now views long embargoes as dangerous and primarily useful to attackers, as it has recently seen AI agents find the same bugs, sometimes within hours.
No CVE identifier has been assigned to the flaw to date.
Gn tech
