Alpine Linux users who run OpenSSH without PAM integration face a serious security risk. A flaw in the musl libc library makes it possible to log in to accounts without a password by using extremely long passwords.
A critical vulnerability in the way OpenSSH and the musl libc library work together has prompted a security advisory from the Alpine Linux developers. The flaw lets attackers gain access to accounts that should be protected against password use, such as the root user or specific cloud users.
The problem arises from a combination of technical choices in the library’s code and the way the SSH daemon verifies passwords. This leaves certain systems open to direct intrusion without a valid password. The vulnerability is the “legacy” of a patch that OpenSSH had to roll out in 2016, which changed the way password hashes are processed.
The cause of the bypass
The core of the problem lies in the crypt() function, which is part of the musl libc library. When a password is longer than 256 characters, this function returns an error in the form of an asterisk (*). This was a deliberate choice to prevent crashes that would occur if the function returned an empty value.
In many Alpine Linux installations, accounts without a password, such as the root user or users who only work with SSH keys, have an asterisk in their password field. When an attacker sends a password of, say, 300 characters, the library returns an asterisk. The SSH daemon compares this with the stored field, sees a match and grants access.
The vulnerability mainly affects systems that do not use PAM. This is the default configuration for the OpenSSH server on Alpine Linux. The risk increases if at least one other account with a valid password hash exists on the same system, which triggers the processing of the faulty request.
Protection and action
The discovery of the bug by security researcher Özgün Kültekin prompted a quick response from the developers, after the vulnerability went unnoticed for ten years. OpenSSH has released a patch in version 10.6p2 that corrects this behaviour. Alpine Linux users are urged to update the openssh package immediately with the command apk upgrade.
After the update, it is crucial to also restart the running sshd daemon. Updating the software packages alone is not enough to secure active connections.
If an update is not possible at the moment, the only safe temporary workaround is to disable password authentication entirely. You can do this by turning off the PasswordAuthentication setting. Users who suspect they have already been affected can search the log files for the message Accepted password for accounts that normally have no password.