Alpine Linux Vulnerability Allows Passwordless Access

A critical vulnerability has been discovered in some Linux distributions, allowing hackers to access devices without a password. The issue affects Alpine Linux and possibly other distributions, where OpenSSH interacts with musl, a lightweight alternative to the libc library.

The vulnerability is rooted in the combination of OpenSSH and musl, which must not use PAM (pluggable authentication modules) for user authentication. This is in contrast to most other Linux distributions, which employ different configurations. Alpine's widespread adoption as a lightweight Linux distribution makes it a prime target for potential exploitation.

Two additional conditions are necessary for successful exploitation: the presence of a user account with a password hashed using SHA256 or SHA512 functions, and the configuration of the target system account as passwordless. The latter condition involves specifying a "*" in the password field in /etc/shadow, a common setup for certificate-based authentication.

Passwordless accounts are often used for specific types of accounts, but this setting may also inadvertently leave devices vulnerable to attack. Further investigation is needed to determine whether other platforms are affected by this configuration.

The consequences of this vulnerability are severe, allowing attackers to gain access to Linux devices without needing a password. According to the Alpine maintainers, an attacker can log in using just one connection and it will work every time, without requiring any retries.

When logging into a passwordless account, the attacker can exploit another weakness by inputting more than 256 characters in the password field. This allows them to gain access, even if they don't know the actual password. The maintainers have highlighted this potential entry point.

Security researchers at Checkpoint have shed further light on the vulnerability's requirements. They found that using SHA256 or SHA512 functions is crucial, as it allows sshd to borrow the account's salt. Without this, the attack will fail. Additionally, Checkpoint discovered that the account must be active and not just hold a hash.

The company also reported that root accounts are generally safe under the default PermitRootLogin prohibit password setting. However, reachable accounts with doas or sudo rights can still become root if exploited. This means that users need to be vigilant about access control on their systems.

Despite these specific requirements, *sshole is likely a significant threat to many systems. The Docker Hub base image for Alpine has been downloaded over 1 billion times, indicating widespread adoption of the operating system in various devices and applications.

Security experts estimate that around 22 million systems have SSH enabled on port 22, according to data from Shodan. While not all of these devices meet the specific conditions required for exploitation, locating vulnerable machines is likely to be a relatively straightforward process due to the ease and speed of testing.

The exact cause of the vulnerability remains unclear. OpenSSH has released an update, stating that the root issue lies outside its own software but can still be exploited through its interface. Meanwhile, Rich Felker, a developer of the Musl library, believes the problem stems from incorrect usage rather than a bug in his code.

Musl developers have been planning to modify the relevant mechanism for some time and intend to do so in an upcoming release. Alpine has also issued an update to address the issue. The updates indicate that the vulnerability is being taken seriously by major players in the Linux community.

While the full extent of the vulnerability's impact remains unknown, it's been reported that other packages may be affected. The discoverer of *sshole claims that OpenWRT is vulnerable, although it typically uses Dropbear for SSH connections rather than OpenSSH. Further investigation is needed to confirm whether buildroot and yocto are also at risk.

Users of Linux systems that combine musl and OpenSSH are advised to conduct an immediate assessment to determine if they are vulnerable to this issue.

A good starting point for affected users is to visit a specified website, where both Alpine and OpenSSH patches can be found to address the vulnerability, which currently lacks a CVE designation.