Decade-old Alpine Linux and OpenSSH flaw lets attackers log in without a password
Some Alpine Linux configurations, and possibly other distributions, are open to passwordless SSH logins using an overly long password-field input. The flaw has existed for about ten years.
Devices running certain configurations of Alpine Linux, and possibly other Linux distributions, are affected by a vulnerability roughly a decade old. It lets an attacker remotely log in over SSH, the secure remote-access protocol, without any password. Alpine is a lightweight and widely used Linux distribution.
Where the problem lies
The flaw arises from the interaction between OpenSSH, the code library that implements SSH connections, and musl, a lightweight alternative to the libc library that Alpine uses, unlike most other Linux distributions. In addition, OpenSSH running with musl must not use PAM (pluggable authentication modules, a framework that handles user authentication and account-access checks).
Required conditions
Two more conditions must be met. First, the system needs at least one user account reachable with a password hashed using SHA256 or SHA512. Second, the targeted account must be passwordless, with a "*" in the password field of /etc/shadow, the file where password hashes are stored. Such accounts are commonly used with certificate-based authentication.
When everything lines up, the consequences are serious. Alpine maintainers said on Thursday that an attacker who can reach the SSH port can log in without knowing any password, needing just one connection, with success every time and no retries. To get into a passwordless account, the attacker enters more than 256 characters in the password field.
Security firm Checkpoint explained that SHA256 or SHA512 matters because sshd borrows that account's salt; without it, the attack fails. Its researchers also found that the account must be active, not merely hold a hash. Checkpoint added that root accounts are safe under the default PermitRootLogin prohibit-password setting, though reachable accounts with doas or sudo rights can still become root.
