Alpine Linux has issued a security advisory for a critical vulnerability in OpenSSH that allows attackers to log in without knowing any password.
According to the advisory, an attacker who can reach an SSH port can gain access with a single connection attempt. The vulnerability requires two conditions: the machine must have at least one account with a password field marked as * (typical for key-only accounts), and at least one other account with a $5$ or $6$ password hash. The attacker then sends a very long password between 257 and 1024 bytes, which triggers the vulnerability.
The flaw exists in OpenSSH built without PAM (Pluggable Authentication Modules) when password authentication is enabled. When sshd hashes a password attempt using the C library’s crypt() function, it borrows the salt from another account’s password field if the stored field is too short. When the password exceeds 256 bytes, musl’s crypt() returns the string * as an error indicator—which exactly matches the password field of passwordless accounts, allowing login to succeed.
Affected systems include those running Alpine 3.16 through 3.24 and edge releases, provided they run openssh-server without PAM or with UsePAM disabled, have password authentication enabled (the default), and meet the account configuration requirements. The advisory notes that root ships as root:* in the base image since Alpine 3.16, making it potentially exploitable if PermitRootLogin is set to yes. The official tiny-cloud images from versions 3.18.11 through 3.24.3 ship an alpine user vulnerable to this attack.
Alpine has released fixed packages across all affected versions. Users should run apk upgrade -U -a and restart sshd afterward, as upgrading the package alone does not replace the running daemon. Fixed versions range from 9.0_p1-r6 for Alpine 3.16 through 10.6_p2-r0 for edge.
For those unable to update immediately, disabling password authentication by setting PasswordAuthentication no in sshd configuration closes the vulnerability. Systems using openssh-server-pam with UsePAM yes, those without password-protected accounts, and container deployments that do not run sshd are unaffected. The advisory recommends checking /var/log/messages for suspicious “Accepted password” entries for passwordless accounts to detect prior exploitation.
Key facts
- An attacker can log in without a password using a single connection attempt by sending a 257-1024 byte password
- Vulnerability affects Alpine Linux 3.16 through 3.24 running OpenSSH without PAM or with UsePAM disabled
- Exploit requires at least one passwordless account (marked with *) and one account with a $5$ or $6$ password hash
- Fixed packages available across all affected Alpine versions; users must restart sshd after updating
- Disabling password authentication (PasswordAuthentication no) closes the vulnerability for systems unable to update immediately