Authentication bypass in Alpine Linux via SSH discovered — fix already released
The vulnerability allows logging into certain accounts without knowing the password. It affects specific OpenSSH configurations using the musl library and with PAM support disabled.
The Alpine Linux developers have warned about an authentication bypass vulnerability dubbed *sshole. Exploiting it requires network access to the SSH server, but the issue only manifests under a combination of several conditions.
The vulnerable system must use musl and OpenSSH without active PAM support—a user verification mechanism. Additionally, password-based login must be enabled, and accounts with specific password storage settings must be present.
According to Alpine, under such conditions, an attacker can log into a suitable account without knowing its password. Gaining administrative privileges depends on the permissions of that account. The default OpenSSH configuration, which disables password-based root login, prevents direct access to this account.
The issue does not automatically affect all Alpine Linux installations or containers based on it. In particular, containers without a running SSH server are not vulnerable to this attack.
Fixes have been released in OpenSSH 10.6p2 and Alpine Linux packages. The developers emphasize that after updating, the sshd service must be restarted—simply installing the package is insufficient. A temporary measure is to disable password authentication after verifying that SSH key-based login works.
Whether the issue exists in other distributions depends on the components and configuration used.
