OpenSSH 10.6p2 Fixes Critical Long-Password Authentication Bypass on Alpine Linux
Summary
A flaw in Alpine's standard OpenSSH package can let network attackers log in to passwordless accounts using passwords 257–1,024 bytes long under specific conditions. OpenSSH 10.6p2 and fixed Alpine packages address it; no attacks have been reported.
Key points
- The flaw affects Alpine systems using OpenSSH without PAM when password authentication is enabled and at least one account has a password hash.
- An attacker needs network access, the name of a passwordless account, and a password between 257 and 1,024 bytes; the advisory says a single connection can succeed.
- The issue arises when musl's crypt() rejects passwords over 256 bytes and returns an asterisk that matches the stored field for an account without a password.
- OpenSSH 10.6p2 prevents the match, and Alpine has published fixed packages, including for releases back to 3.16.
- Alpine users should update and restart sshd. Disabling PasswordAuthentication also blocks the attack; no exploitation has been reported.
- Systems using PAM, glibc, disabled password authentication, or no sshd are not affected. OpenWrt uses unaffected Dropbear by default, though installations with OpenSSH may be vulnerable.
Article Details
- Vulnerability Types
- SSH password authentication bypass
- Authentication bypass caused by a failed password-hash operation matching an empty-password account field
- Severity
- Critical, as rated by OpenSSH
- Affected Versions
- Alpine tiny-cloud images 3.18.11–3.24.3 (conditionally exposed when a $6$ hash exists on the machine)
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Set PasswordAuthentication=no.
- Disable SSH on affected systems.
CVE
People
Vendors
AlpineAttackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name,OpenSSHthat have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and
Products
Alpine LinuxAttackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name,DropbearOpenWrt handles SSH with Dropbear by default, as its Dropbear documentation shows, and Kültekin says Dropbear is not affected. On OpenWrt, the flaw can matter only where an admin has installed the OpenSSH server.muslThe flaw comes from how sshd works with musl, the C library that Alpine is built on. Non-Linux systems, Linux systems built on glibc, and systems that check passwords through PAM are not affected, said Damien Miller ofOpenSSHthat have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 andOpenWrtThe flaw is not limited to Alpine. Özgün Kültekin of Wakefield, who reported it, names OpenWrt, Buildroot and Yocto in his technical write-up as other musl-based systems to check.