Ars Technica reports that devices running certain configurations of Alpine Linux face a decade-old Linux vulnerability enabling attackers to log into systems without providing any password. Disclosed on Thursday, the security flaw stems from how OpenSSH interacts with musl, which is a lightweight alternative to the libc library.
Key takeaways
- Alpine Linux and potentially other distributions are affected by a decade-old authentication flaw.
- The bug allows attackers to log in instantly without needing retries or passwords.
- Exploitation requires specific password hashing and passwordless account configurations.
- Root accounts remain safe under default settings, but accounts with sudo rights pose risks.
How does the Linux vulnerability work?
The flaw requires OpenSSH using musl to operate without PAM, which is the framework handling user authentication checks. Alpine relies on this lightweight setup, though other platforms using identical configurations might also be vulnerable. According to Ars Technica, attackers reaching the SSH port can bypass authentication entirely by entering more than 256 characters inside the password field.
Certain conditions must align for the exploit to function properly on a target system. At least one user account must rely on a password hashed via SHA256 or SHA512 functions. Security firm Checkpoint explained that sshd borrows the salt from that account, and without it, the attack fails entirely. Also, the targeted account has to be configured as passwordless by placing a star symbol in the password field of the shadow file.
What it means for device security
Alpine maintainers warned Thursday that the exploit requires just a single connection to succeed every time without requiring retries. Checkpoint researchers noted that active accounts are necessary for the exploit to work, rather than just holding a hash. While default settings protect root accounts under specific configurations, reachable accounts possessing doas or sudo privileges can still elevate privileges to root.
Frequently asked questions
It is a security flaw affecting Alpine Linux and potentially other distributions that lets attackers log into devices via SSH without a password.
The issue involves the interaction between OpenSSH and musl, a lightweight alternative to the libc library used in Alpine.
The system must use OpenSSH with musl without PAM, have a password hashed with SHA256 or SHA512, and feature a passwordless account.
When connecting to a passwordless account, an attacker can log in by inputting more than 256 characters into the password field.
Root accounts remain safe under the default prohibit password setting, though reachable accounts with sudo or doas rights can still become root.
Based on reporting by Ars Technica. Read the original article
