Alpine Linux and OpenSSH patch flaw that’s as bad as it can get

ZDNET’s cardinal takeaways

• An past bug is affecting Alpine Linux and a fewer different Linux distros. 
• It’s astir arsenic atrocious arsenic it tin get.
• You indispensable spot ASAP, and past restart the patched software.

The cleanable nightmare script for a Linux server is erstwhile each an attacker needs to bash is scope the server’s Secure Shell (SSH) port, waltz close in, and instrumentality it over. That’s what happened to Alpine Linux, the popular, lightweight Linux server. Adding insult to injury, this happened lone days aft Alpine Linux dodged a information hole-sized bullet to its GitLab implementation. 

Also: Linux Mint 27 arrives adjacent month, and I similar it already: What to expect

How the onslaught works

As information technologist Gregory Bryant explained successful his LinkedIn post:

Most authentication bypasses travel from analyzable logic chains, but yesterday’s Alpine Linux OpenSSH vulnerability (CVE-2026-123158) comes down to a azygous character: *.”

If you tally Alpine Linux (or different musl-based distro) with the default openssh-server bundle (no Pluggable Authentication Modules (PAM)) and PasswordAuthentication enabled, an attacker tin log into password-disabled, oregon key-only accounts simply by sending a password betwixt 257 and 1024 bytes long.

That’s it. That’s all. 

Alpine Linux isn’t the lone operating strategy that uses musl, a lightweight mentation of the modular C room (libc). Other operating systems that usage musl and are perchance susceptible see Adélie Linux; Void Linux; Sabotage Linux; OpenWrt, an Android variant,  and the Yocto Project, which is utilized to physique embedded Linux distributions. 

Also: This clever banking scam keeps phishing by faking its ain demise

Wind River, which produces the commercialized embedded Linux distro, Wind River Linux, is besides looking into the issue. A institution typical told me, “Wind River takes information seriously. We are actively reviewing the reported vulnerability and assessing its imaginable impact. We volition instrumentality due enactment arsenic needed.”

Behind the scenes, erstwhile OpenSSH is built without PAM, it verifies passwords by hashing the password effort utilizing the C library’s crypt() function. It past compares the effect to the account’s stored password field. So far, truthful good.

But erstwhile a cardinal is longer than 256 bytes, musl’s crypt() relation returns the drawstring * arsenic an mistake indicator. That is besides what the password tract holds for immoderate relationship with nary password, specified arsenic a key-only account. Thus, the “hash” matches and the login succeeds, and the attacker walks in. 

Also: The caller Cutefish Linux distro mightiness beryllium the champion MacOS clone around

To exploit it, an attacker lone needs the sanction of specified an account. The attacker besides needs astatine slightest 1 different relationship connected the instrumentality with a 5 oregon 6 password hash, and past to nonstop a password of 257 to 1,024 bytes. According to Alpine, 1 idiosyncratic with a password is capable to marque each passwordless relationship accessible.

In Linux systems that usage glibc’s crypt(), which is astir each of them, the aforesaid effort would instrumentality NULL connected error, which sshd already rejects, truthful Debian, Ubuntu, Fedora, etc., aren’t affected. 

According to *sshole, the radical that uncovered the problem, this is simply a broadside effect that has been hiding since 2016.

Who’s exposed

Alpine said each merchandise it checked is affected: 3.21 done 3.24, edge, and the older 3.16 to 3.20 branches. Exposure requires the following:

• The openssh-server package, which is built without PAM, oregon openssh-server-pam with UsePAM no.
• PasswordAuthentication acceptable to yes, which is the OpenSSH default.
• An relationship with * arsenic its password field, and different relationship with a 5 oregon 6 hash.

Root is not straight exposed successful astir cases. It has shipped arsenic root:* successful the basal representation since astir Alpine 3.16, but OpenSSH’s default PermitRootLogin prohibit-password blocks it. Another relationship that tin go root, for illustration done doas, inactive gives an attacker a way to root.

Alpine singled retired its authoritative tiny-cloud images, versions 3.18.11 done 3.24.3, arsenic particularly vulnerable. These vessel with an alpine idiosyncratic with a * password tract and passwordless doas. They are harmless connected archetypal footwear but go exploitable erstwhile immoderate 6 hash exists connected the machine. That tin hap erstwhile an head sets a console password oregon erstwhile idiosyncratic information adds a idiosyncratic with a hashed password, which means, essentially, each of them. 

Alpine said these are not affected:

• Containers that bash not tally sshd.
• Systems with password authentication disabled.
• Systems utilizing openssh-server-pam with UsePAM yes.
• Locked accounts with! successful the password field.
• Cloud images configured done cloud-init, which writes PasswordAuthentication no.

The fix

Alpine released 3.21.10, 3.22.8, 3.23.8 and 3.24.4 connected Thursday, with the OpenSSH fix among the information changes. It besides published fixed packages for each merchandise backmost to 3.16. Alpine 3.21 reached extremity of enactment connected Nov. 1.

The just-released OpenSSH 10.6p2 avoids the occupation successful sshd. Alpine’s unchangeable branches transportation a spot for the aforesaid problem. You should tally apk upgrade -U -a and past restart the daemon with rc-service sshd restart. Alpine stressed that upgrading the bundle does not regenerate the moving daemon. Anyone who cannot update should acceptable PasswordAuthentication nary and restart sshd, aft confirming that cardinal login works.

Also: Maze Linux is the champion security-focused distro I’ve ever tested

To cheque for an attack, Alpine told administrators to hunt /var/log/messages for “Accepted password for” lines that sanction an relationship with nary password. It besides advised reviewing dedicated OpenBSD exertion subexecutor (doas) usage and precocious created users, files, and authorized keys. “If you cannot regularisation retired a login, dainty the instrumentality arsenic compromised.” Just what you wanted for your weekend, I know, but present we are. 

Steven Vaughan-Nichols

Senior Contributing Editor

Steven J. Vaughan-Nichols is simply a freelance writer and exertion analyst. Besides ZDNET, helium works with ComputerWorld, The Register, The New Stack, TechStrong, and Cathey Communications. He doesn't ain stocks oregon different investments successful immoderate exertion company. See afloat bio