Recent revelations have uncovered a significant vulnerability within devices utilizing certain configurations of Alpine Linux. This flaw, which has persisted for over ten years, enables attackers to gain unauthorized access to devices without needing a password.

The Underlying Problem

This vulnerability arises from the combination of OpenSSH—the software responsible for secure shell (SSH) connections—and musl, a minimal alternative to the traditional libc library commonly used in many Linux distributions. Crucially, for this vulnerability to manifest, OpenSSH must operate without PAM (Pluggable Authentication Modules), which usually provides a robust framework for user authentication and access control. Since Alpine Linux is designed for efficiency and minimalism, it frequently opts for this configuration.

Conditions for Exploitation

For this vulnerability to be effectively exploited, specific conditions must be met:

• The target system must have at least one user account secured by a password hashed with either the SHA256 or SHA512 functions.
• The account must also be configured to allow passwordless access, typically by entering a “*” in the password field of /etc/shadow, the file storing password hashes.

Passwordless accounts are often established for those utilizing certificate-based authentication, making these settings relatively prevalent.

Impact of the Vulnerability

If an attacker can access the SSH port of a vulnerable system, they are able to log in without possessing any password credentials. As stated by Alpine maintainers, “It takes one connection, works every time, and needs no retries.” Once inside a passwordless account, the attacker can enter more than 256 characters in the password field to gain access.

Security Firm Insights

Research by security firm Checkpoint reveals that the specific hashing functions—SHA256 or SHA512—are critical, as the sshd service utilizes the salt from the account’s password hash, essential for mounting a successful attack. Additionally, it’s important to note that the user account targeted must be active; merely having a stored hash is insufficient for exploitation.

Checkpoint’s findings indicate that root accounts remain secure under the default configuration of PermitRootLogin prohibit-password, though accounts with doas or sudo privileges may still be compromised, enabling attackers to escalate their access permissions.