Critical OpenSSH Flaw Lets Attackers Log In to Passwordless Accounts on Alpine Linux

OpenSSH has issued an emergency fix for a critical flaw affecting some Alpine Linux servers. An attacker with network access, a valid account name and a password between 257 and 1,024 bytes long can log in to accounts that have no password, such as accounts that use SSH keys only. OpenSSH released version 10.6p2 to block the attack, and Alpine has published fixed packages for every release back to 3.16. No attacks using the flaw have been reported.

The problem arises when the OpenSSH server checks passwords without the Pluggable Authentication Module (PAM) interface, password logins are enabled, and at least one other account on the machine has a password. Alpine's openssh-server package is built without PAM and has password logins on by default. The flaw comes from how the server works with musl, the C library Alpine is built on. Damien Miller of the OpenSSH project said non-Linux systems, glibc-based Linux systems and systems that check passwords through PAM are not affected. According to the Alpine advisory, the attack succeeds on every try with a single connection.

Root is protected by the default PermitRootLogin prohibit-password setting, but that does not help if an exposed account can become root, for example through doas. Alpine tiny-cloud images from 3.18.11 through 3.24.3 give the alpine user passwordless doas, so they become open to attack once any password hash exists on the machine. Containers without sshd, systems with PasswordAuthentication set to no, and cloud-init images are not affected. Miller advised affected users to set PasswordAuthentication=no or disable SSH immediately.