Alpine Linux Vulnerability Enables Passwordless SSH Access via Musl Library Conflict
A decade-old security flaw affecting Alpine Linux and other distributions using the musl C library allows attackers to bypass SSH authentication. As Ars Technica reports, the vulnerability enables unauthorized logins to specific passwordless accounts without requiring credentials, provided the target system meets several configuration criteria involving password hashing and authentication modules.
Context from Industry Pulse
The discovery of a decade-old vulnerability in Alpine Linux highlights the risks inherent in specialized, lightweight distributions that deviate from standard Linux libraries like libc. By opting for musl and bypassing Pluggable Authentication Modules, these systems achieve smaller footprints but may introduce unique security interactions that remain hidden for years. This specific flaw demonstrates how legacy configurations in modern cloud and container environments, where Alpine is frequently used, can create critical entry points. The requirement for SHA256 or SHA512 hashing indicates that even modern security standards can be subverted when combined with specific library behaviors and passwordless account configurations common in automated environments.
The security flaw originates from a specific interaction between the OpenSSH code library and musl, which is a lightweight alternative to the standard libc library. According to Ars Technica, the vulnerability primarily impacts systems where OpenSSH is configured without Pluggable Authentication Modules. While Alpine Linux is the most prominent distribution using this configuration, other platforms utilizing similar lightweight setups could also be at risk.
Successful exploitation requires the presence of a user account configured for passwordless access, often indicated by a specific character in the shadow file. Ars Technica reports that these accounts are frequently used for certificate-based authentication. Furthermore, the targeted account must have a password hash generated via SHA256 or SHA512 functions because the exploit relies on borrowing the salt from that specific account to function.
Security researchers at Checkpoint discovered that an attacker can gain entry by submitting a string longer than 256 characters into the password field. As Ars Technica notes, the attack is highly reliable and does not require multiple attempts to succeed once the initial connection to the SSH port is established. The researchers also clarified that the targeted account must be currently active rather than just holding a stored hash.
Default security settings may offer some protection for certain high-level accounts. According to Ars Technica, root accounts remain secure under default configurations that prohibit password-based root logins. However, the risk remains significant because any reachable account with sudo or doas privileges could be leveraged by an attacker to eventually gain full administrative control over the affected Linux device.
The Industry Pulse Bottom Line
Security teams using Alpine Linux should immediately audit shadow files for passwordless accounts and verify SSH configurations. The reliability of this exploit makes patching a priority for any lightweight Linux deployment exposed to public networks.