Critical Authentication Bypass Vulnerability Found in Alpine Linux OpenSSH
A password length flaw allows unauthorized access to accounts using asterisk-based authentication.
1The Core Vulnerability
Alpine Linux systems running OpenSSH are vulnerable to an authentication bypass. When a user provides a password exceeding 256 bytes, the musl C library's crypt function returns an asterisk. Because accounts without passwords also store an asterisk in their shadow file, the system incorrectly validates the login attempt as successful.
2Exploitation Mechanism
An attacker requires the name of an account with a locked password field, represented by an asterisk. By sending a password between 257 and 1024 bytes, the attacker triggers the crypt failure. If the machine contains at least one other account with a standard hash, the system borrows its salt, completing the bypass.
3Impact on Cloud Images
Official Alpine cloud images, including AMI and VHD artifacts, are particularly exposed. These images often include an 'alpine' user with an asterisk password and passwordless doas privileges. Once an administrator adds a single user with a hashed password, the system becomes fully exploitable, potentially granting an attacker immediate root-level access.
4Scope of Affected Releases
The vulnerability affects a wide range of Alpine versions, specifically releases 3.16 through 3.24, including the edge branch. While some versions have reached their end of support, maintainers have published patched packages for all these releases. Users must verify their specific version and apply the provided security updates immediately to mitigate risk.
5Immediate Remediation Steps
Administrators should update OpenSSH to version 10.6p2 or the latest patched release via apk. Crucially, simply upgrading the package is insufficient; the sshd daemon must be restarted using rc-service sshd restart. If an immediate update is not possible, disabling password authentication in the sshd configuration serves as an effective temporary security measure.
6Configuration Hardening
To disable password logins, set PasswordAuthentication no in the sshd configuration. On newer Alpine releases, this can be done by creating a drop-in file in /etc/ssh/sshd_config.d/. After modifying the configuration, run sshd -t to verify the syntax before restarting the service to ensure the changes take effect without locking out legitimate users.
7Forensic Review Requirements
Security teams should inspect /var/log/messages for entries indicating accepted passwords for accounts that typically lack them, such as root or alpine. It is essential to review recent doas usage, newly created user accounts, and modified authorized_keys files. If any suspicious activity is detected, the machine should be treated as fully compromised.
8Broader System Context
This issue highlights the risks of non-standard libc implementations like musl when interacting with complex software like OpenSSH. While most distributions use PAM, which avoids this specific crypt behavior, Alpine's direct reliance on musl created this unique failure point. The fix ensures that sshd no longer inadvertently validates passwords against error-indicator strings.