ZDNET’s key takeaways
- An historic bug is affecting Alpine Linux and some different Linux distros.
- It’s about as dangerous as it could possibly get.
- You need to patch ASAP, after which restart the patched software program.
The proper nightmare situation for a Linux server is when all an attacker must do is attain the server’s Safe Shell (SSH) port, waltz proper in, and take it over. That’s what occurred to Alpine Linux, the favored, light-weight Linux server. Including insult to damage, this occurred solely days after Alpine Linux dodged a safety hole-sized bullet to its GitLab implementation.
Additionally: Linux Mint 27 arrives subsequent month, and I prefer it already: What to anticipate
How the assault works
As safety engineer Gregory Bryant defined in his LinkedIn publish:
Most authentication bypasses come from complicated logic chains, however yesterday’s Alpine Linux OpenSSH vulnerability (CVE-2026-123158) comes right down to a single character: *.”
If you happen to run Alpine Linux (or one other musl-based distro) with the default openssh-server package deal (no Pluggable Authentication Modules (PAM)) and PasswordAuthentication enabled, an attacker can log into password-disabled, or key-only accounts just by sending a password between 257 and 1024 bytes lengthy.
That’s it. That’s all.
Alpine Linux isn’t the one working system that makes use of musl, a light-weight model of the usual C library (libc). Different working programs that use musl and are doubtlessly susceptible embrace Adélie Linux; Void Linux; Sabotage Linux; OpenWrt, an Android variant, and the Yocto Venture, which is used to construct embedded Linux distributions.
Additionally: This intelligent banking rip-off retains phishing by faking its personal demise
Wind River, which produces the industrial embedded Linux distro, Wind River Linux, can be wanting into the difficulty. An organization consultant instructed me, “Wind River takes safety critically. We’re actively reviewing the reported vulnerability and assessing its potential influence. We’ll take acceptable motion as wanted.”
Behind the scenes, when OpenSSH is constructed with out PAM, it verifies passwords by hashing the password try utilizing the C library’s crypt() perform. It then compares the end result to the account’s saved password area. Up to now, so good.
However when a key’s longer than 256 bytes, musl’s crypt() perform returns the string * as an error indicator. That can be what the password area holds for any account with no password, comparable to a key-only account. Thus, the “hash” matches and the login succeeds, and the attacker walks in.
Additionally: The brand new Cutefish Linux distro may be the most effective MacOS clone round
To use it, an attacker solely wants the identify of such an account. The attacker additionally wants at the very least one different account on the machine with a 5 or 6 password hash, after which to ship a password of 257 to 1,024 bytes. Based on Alpine, one consumer with a password is sufficient to make each passwordless account accessible.
In Linux programs that use glibc’s crypt(), which is nearly all of them, the identical try would return NULL on error, which sshd already rejects, so Debian, Ubuntu, Fedora, and many others., aren’t affected.
Based on *sshole, the group that uncovered the issue, it is a aspect impact that has been hiding since 2016.
Who’s uncovered
Alpine mentioned each launch it checked is affected: 3.21 by means of 3.24, edge, and the older 3.16 to three.20 branches. Publicity requires the next:
- The openssh-server package deal, which is constructed with out PAM, or openssh-server-pam with UsePAM no.
- PasswordAuthentication set to sure, which is the OpenSSH default.
- An account with * as its password area, and one other account with a 5 or 6 hash.
Root shouldn’t be straight uncovered normally. It has shipped as root:* within the base picture since about Alpine 3.16, however OpenSSH’s default PermitRootLogin prohibit-password blocks it. One other account that may change into root, for instance by means of doas, nonetheless provides an attacker a path to root.
Alpine singled out its official tiny-cloud photographs, variations 3.18.11 by means of 3.24.3, as particularly susceptible. These ship with an alpine consumer with a * password area and passwordless doas. They’re secure on first boot however change into exploitable as soon as any 6 hash exists on the machine. That may occur when an administrator units a console password or when consumer knowledge provides a consumer with a hashed password, which suggests, basically, all of them.
Alpine mentioned these will not be affected:
- Containers that don’t run sshd.
- Programs with password authentication disabled.
- Programs utilizing openssh-server-pam with UsePAM sure.
- Locked accounts with! within the password area.
- Cloud photographs configured by means of cloud-init, which writes PasswordAuthentication no.
The repair
Alpine launched 3.21.10, 3.22.8, 3.23.8 and three.24.4 on Thursday, with the OpenSSH repair among the many safety modifications. It additionally revealed mounted packages for every launch again to three.16. Alpine 3.21 reached finish of help on Nov. 1.
The just-released OpenSSH 10.6p2 avoids the issue in sshd. Alpine’s steady branches carry a patch for a similar downside. It is best to run apk improve -U -a after which restart the daemon with rc-service sshd restart. Alpine careworn that upgrading the package deal doesn’t change the working daemon. Anybody who can’t replace ought to set PasswordAuthentication no and restart sshd, after confirming that key login works.
Additionally: Maze Linux is the most effective security-focused distro I’ve ever examined
To verify for an assault, Alpine instructed directors to go looking /var/log/messages for “Accepted password for” strains that identify an account with no password. It additionally suggested reviewing devoted OpenBSD utility subexecutor (doas) use and lately created customers, information, and licensed keys. “If you happen to can’t rule out a login, deal with the machine as compromised.” Simply what you needed on your weekend, I do know, however right here we’re.
See full bio
