ZDNET’s key takeaways
- An historic bug is affecting Alpine Linux and some different Linux distros.
- It’s about as unhealthy as it will possibly get.
- You need to patch ASAP, after which restart the patched software program.
The proper nightmare situation for a Linux server is when all an attacker must do is attain the server’s Safe Shell (SSH) port, waltz proper in, and take it over. That’s what occurred to Alpine Linux, the favored, light-weight Linux server. Including insult to damage, this occurred solely days after Alpine Linux dodged a safety hole-sized bullet to its GitLab implementation.
Additionally: Linux Mint 27 arrives subsequent month, and I prefer it already: What to anticipate
How the assault works
As safety engineer Gregory Bryant defined in his LinkedIn put up:
Most authentication bypasses come from advanced logic chains, however yesterday’s Alpine Linux OpenSSH vulnerability (CVE-2026-123158) comes all the way down to a single character: *.”
Should you run Alpine Linux (or one other musl-based distro) with the default openssh-server bundle (no Pluggable Authentication Modules (PAM)) and PasswordAuthentication enabled, an attacker can log into password-disabled, or key-only accounts just by sending a password between 257 and 1024 bytes lengthy.
That’s it. That’s all.
Alpine Linux isn’t the one working system that makes use of musl, a light-weight model of the usual C library (libc). Different working techniques that use musl and are probably weak embody Adélie Linux; Void Linux; Sabotage Linux; OpenWrt, an Android variant, and the Yocto Undertaking, which is used to construct embedded Linux distributions.
Additionally: This intelligent banking rip-off retains phishing by faking its personal demise
Wind River, which produces the industrial embedded Linux distro, Wind River Linux, can also be trying into the difficulty. An organization consultant advised me, “Wind River takes safety severely. We’re actively reviewing the reported vulnerability and assessing its potential affect. We are going to take applicable motion as wanted.”
Behind the scenes, when OpenSSH is constructed with out PAM, it verifies passwords by hashing the password try utilizing the C library’s crypt() perform. It then compares the consequence to the account’s saved password area. To this point, so good.
However when a secret’s longer than 256 bytes, musl’s crypt() perform returns the string * as an error indicator. That can also be what the password area holds for any account with no password, reminiscent of a key-only account. Thus, the “hash” matches and the login succeeds, and the attacker walks in.
Additionally: The brand new Cutefish Linux distro is perhaps one of the best MacOS clone round
To use it, an attacker solely wants the identify of such an account. The attacker additionally wants no less than one different account on the machine with a 5 or 6 password hash, after which to ship a password of 257 to 1,024 bytes. In response to Alpine, one consumer with a password is sufficient to make each passwordless account accessible.
In Linux techniques that use glibc’s crypt(), which is nearly all of them, the identical try would return NULL on error, which sshd already rejects, so Debian, Ubuntu, Fedora, and so forth., aren’t affected.
In response to *sshole, the group that uncovered the issue, this can be a aspect impact that has been hiding since 2016.
Who’s uncovered
Alpine stated each launch it checked is affected: 3.21 by way of 3.24, edge, and the older 3.16 to three.20 branches. Publicity requires the next:
- The openssh-server bundle, which is constructed with out PAM, or openssh-server-pam with UsePAM no.
- PasswordAuthentication set to sure, which is the OpenSSH default.
- An account with * as its password area, and one other account with a 5 or 6 hash.
Root isn’t instantly uncovered typically. It has shipped as root:* within the base picture since about Alpine 3.16, however OpenSSH’s default PermitRootLogin prohibit-password blocks it. One other account that may change into root, for instance by way of doas, nonetheless offers an attacker a path to root.
Alpine singled out its official tiny-cloud photos, variations 3.18.11 by way of 3.24.3, as particularly weak. These ship with an alpine consumer with a * password area and passwordless doas. They’re secure on first boot however change into exploitable as soon as any 6 hash exists on the machine. That may occur when an administrator units a console password or when consumer knowledge provides a consumer with a hashed password, which suggests, primarily, all of them.
Alpine stated these usually are not affected:
- Containers that don’t run sshd.
- Techniques with password authentication disabled.
- Techniques utilizing openssh-server-pam with UsePAM sure.
- Locked accounts with! within the password area.
- Cloud photos configured by way of cloud-init, which writes PasswordAuthentication no.
The repair
Alpine launched 3.21.10, 3.22.8, 3.23.8 and three.24.4 on Thursday, with the OpenSSH repair among the many safety modifications. It additionally revealed mounted packages for every launch again to three.16. Alpine 3.21 reached finish of help on Nov. 1.
The just-released OpenSSH 10.6p2 avoids the issue in sshd. Alpine’s steady branches carry a patch for a similar downside. It’s best to run apk improve -U -a after which restart the daemon with rc-service sshd restart. Alpine confused that upgrading the bundle doesn’t change the operating daemon. Anybody who can not replace ought to set PasswordAuthentication no and restart sshd, after confirming that key login works.
Additionally: Maze Linux is one of the best security-focused distro I’ve ever examined
To examine for an assault, Alpine advised directors to look /var/log/messages for “Accepted password for” traces that identify an account with no password. It additionally suggested reviewing devoted OpenBSD utility subexecutor (doas) use and lately created customers, information, and licensed keys. “Should you can not rule out a login, deal with the machine as compromised.” Simply what you wished to your weekend, I do know, however right here we’re.