OpenSSH has released an emergency fix for a critical authentication flaw that could let attackers log in to passwordless accounts on some Alpine Linux servers. The attack requires network access, a known account name, and a password between 257 and 1,024 bytes long.
The vulnerability affects servers using Alpine’s standard openssh-server package when password authentication is enabled, the server does not use PAM, and at least one local account has a password hash beginning with $5$ or $6$. Since password authentication is enabled by default in Alpine’s OpenSSH configuration, systems meeting the other conditions may be exposed.
The issue stems from how OpenSSH handles password checks with musl, the C library used by Alpine. When musl’s crypt() function receives a password longer than 256 bytes, it returns * to indicate an error. For an account with no password, the stored password field is also *, causing the failed check to be treated as a match.
Potentially affected accounts include key-only users, some directory-service accounts, and certain root or alpine accounts in Alpine images. Root access is not directly possible under the default PermitRootLogin prohibit-password setting, but an attacker who compromises an account with privilege escalation rights—such as passwordless doas—may still be able to become root.
The flaw is specific to certain configurations. Systems using PAM for password checks, systems with password authentication disabled, accounts locked with ! in /etc/shadow, and machines without $5$ or $6$ password hashes are not affected. OpenWrt uses Dropbear by default, which is not vulnerable, though systems with OpenSSH installed should be checked. Other musl-based environments, including Buildroot and Yocto, may also warrant review.
OpenSSH rates the vulnerability as critical. No attacks exploiting it had been reported at the time of disclosure, and no CVE identifier had been assigned.
OpenSSH 10.6p2 includes a fix. Alpine has also issued corrected packages across supported releases, as well as older branches dating back to version 3.16. Administrators should update packages and restart the SSH service:
apk upgrade -U -arc-service sshd restartUpgrading alone does not restart the running SSH server.
If an update is not immediately possible, disable password-based SSH authentication. First verify that key-based login works, and keep the current session open until a new login succeeds. Then set PasswordAuthentication no, validate the configuration with sshd -t, and restart the service. Confirm the effective setting with:
sshd -T | grep -i passwordauthenticationThe result should show passwordauthentication no.
Administrators should also review /var/log/messages for SSH entries such as Accepted password for involving passwordless accounts. On potentially exposed servers, check for unexpected doas activity, newly created users, modified files, and unfamiliar authorized keys. If a successful unauthorized login cannot be ruled out, treat the system as compromised.
The OpenSSH fix rejects password matches when the stored password field is shorter than four characters. The project describes this as a workaround, with the underlying behavior arising from the interaction between OpenSSH and musl.
OpenSSH maintainers said they learned of the issue earlier in the week and released the fix quickly. The project’s Damien Miller said lengthy disclosure embargoes can be risky, noting that AI agents have recently rediscovered some vulnerabilities within hours.
References: Alpine security advisory · OpenSSH 10.6p2 release notes · Technical analysis
ChicagoVPS is your gateway to unparalleled hosting solutions. Our state-of-the-art datacenters and powerful network ensures lightning-fast speeds and uninterrupted connectivity for your websites and applications. Whether you’re a startup looking for scalable resources or an enterprise in need of enterprise-grade hosting, our range of plans and customizable solutions guarantee a perfect fit. Trust in ChicagoVPS to deliver excellence, combining unmatched reliability and top-tier support.
For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@chicagovps.net.
