Alpine Linux users face passwordless login risk via SSH flaw

Alpine Linux maintainers disclosed a security vulnerability on Thursday that allows unauthorized users to log into affected systems without a password. The flaw, dubbed sshole, has existed for roughly ten years and impacts devices running specific configurations of the lightweight Linux distribution.

The bug arises from the interaction between OpenSSH and musl, a lightweight C library that Alpine uses instead of the standard libc. For the vulnerability to be exploitable, the system must run OpenSSH with musl and must not use PAM, the pluggable authentication modules framework that typically manages user access checks. Two additional conditions must be met for a successful exploit.

First, the target system must contain at least one user account with a password hashed using SHA256 or SHA512 functions. Second, the specific account targeted by the attacker must be configured as passwordless. This setup is common for accounts that rely on certificate-based authentication and is typically indicated by an asterisk in the password field of the /etc/shadow file.

Alpine maintainers emphasized the reliability of the exploit, stating that an attacker with access to the SSH port can log in without knowing any password. They noted that the attack takes only one connection, works every time, and requires no retries to succeed. The mechanics involve inputting more than 256 characters into the password field when attempting to log into a passwordless account.

Security firm Checkpoint explained why the specific hashing functions are critical to the exploit. Their researchers found that the sshd daemon borrows the salt from the account’s hash. Without this specific borrowing of the salt, which occurs with SHA256 or SHA512 hashes, the attack would fail. Checkpoint’s testing also revealed that the target account must be active for the exploit to work.

While root accounts are generally protected under the default PermitRootLogin prohibit password setting, other accounts that are reachable and possess doas or sudo rights can still be used to gain full root access on the system. The discovery prompts administrators to audit their authentication setups to ensure that passwordless accounts are properly secured.

System administrators are advised to check their configurations for the specific combination of OpenSSH, musl, and non-PAM authentication. The issue is specific to these configurations but may affect other platforms that utilize similar setups. Ensuring that hashing functions are correctly managed will help mitigate the risk of this long-standing vulnerability being exploited.