Combined OpenSSH and musl libc flaw lets attackers bypass passwords on Alpine and other Linux distros

Emergency fixes and mitigations are being urged after a combined flaw in OpenSSH and musl libc was found to allow access to Alpine Linux, OpenWRT and other Linux distributions without a valid password. By typing more than 256 characters at an SSH password prompt, an attacker can get in on systems where an empty password is set for a system user, a condition that is the default on multiple distributions.

Where the flaw applies

The bug is present, though not necessarily enabled, across Buildroot, Yocto and Void Linux. OpenWRT uses Dropbear for authentication by default, but users can install OpenSSH instead. The largest concern is Alpine, which is described as a common choice for millions of installs across Docker, Kubernetes and Proxmox containers, servers, cloud VMs and embedded devices. Alpine ships with the required conditions set and password authentication enabled by default, which is why it needs immediate patching.

How the vulnerability works

The vulnerability combination involves OpenSSH, musl, password authentication not explicitly disabled, not using PAM, and one arbitrary user with a password set using an SHA-512/256 hash. The problem involves musl's crypt() function returning "*" as an error condition instead of a null value as per usual conventions, and OpenSSH then using that result to compare against a password hash when it should not. An overly long input triggers the chain of mistakes. In /etc/passwd or /etc/shadow, a single asterisk is a placeholder for the password hash for accounts with no password, meaning no password should work.

Mitigation and fixes

Administrators should patch systems immediately, as per the project's advisory note. The easiest mitigation is explicitly setting "PasswordAuthentication" to "no" in the OpenSSH configuration file and restarting the service. While most Alpine and similar installs are not reachable from the internet, an attacker inside a network, including corporate setups, home labs, cloud networks and VPNs, can use the flaw. It takes one valid user account, which may not be hard to obtain in a large enough corporate environment. Scanning and testing the vulnerability is also described as trivial. OpenSSH has published a fix and an advisory post, as did musl author Rich Felker. Both parties seem to believe the other is at fault, but blame is shared.

Earlier coverage: Portable OpenSSH 10.6p2 Released With Security Workaround and Bug Fixes

Sources: Tom's Hardware · Alpine Linux · Ars Technica · The Hacker News