Devices utilizing certain configurations of Alpine Linux, among potentially other Linux distributions, are vulnerable to a significant flaw that permits unauthorized access without the need for a password. This exploit, rooted in a decade-old vulnerability, fundamentally affects how the OpenSSH library interacts with musl, an alternative to the standard libc library typically found in other Linux distributions.

The problem arises particularly when OpenSSH is paired with musl and is not configured to use PAM (Pluggable Authentication Modules). This setup is common in Alpine, a lightweight and increasingly popular Linux variant, but other systems could also face similar risks if they share these configurations.

Simple Exploitation, High Consequences

For this vulnerability to be successfully exploited, two critical conditions must be satisfied. Firstly, the targeted system must include at least one user account that allows access via a password hashed with either the SHA256 or SHA512 functions. Secondly, the account must be configured to be passwordless by placing a “*” in the password field of the /etc/shadow file, which houses password hashes on Linux systems. Such passwordless accounts are frequently employed for those using certificate-based authentication.

If both conditions exist, the exploit can lead to severe implications.

As stated by Alpine maintainers, “An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.” Once inside the system, an attacker can gain access by entering over 256 characters into the password field.

Security firm Checkpoint noted that the choice of using SHA256 or SHA512 hashing is critical since the sshd process utilizes the account’s salt during authentication. Their research also revealed that the account must be active; merely possessing a hash is insufficient. Notably, while root accounts are generally safeguarded due to the default configuration preventing root login via password, accounts with doas or sudo permissions remain susceptible to being exploited for root access.