Critical Vulnerability Found in Alpine Linux's SSH Implementation
Alpine Linux has disclosed a severe vulnerability in its OpenSSH configuration, prompting urgent action for users.
Overview of the Vulnerability
A significant security vulnerability affecting Alpine Linux and other related distributions has raised concerns among system administrators. Identified as CVE-2026-123158, this flaw allows attackers to bypass authentication through a surprisingly simple method involving just one character in the code.
How the Exploit Works
When using the default OpenSSH server package on Alpine Linux without Pluggable Authentication Modules (PAM) and with PasswordAuthentication enabled, the attackers can exploit this vulnerability. By sending a password ranging from 257 to 1024 bytes, an unauthorized user can gain access to accounts that are either password-disabled or configured for key-based logins.
The vulnerability affects Alpine Linux versions across the board, from 3.21 to 3.24, including older versions 3.16 to 3.20. It is especially concerning because the flaw stems from how the musl library processes error codes, leading to validation issues.
Identifying Vulnerable Systems
Any system running with the following conditions is susceptible:
- OpenSSH is installed without PAM support or runs with PAM disabled.
- PasswordAuthentication is set to 'yes', which is typically the default setting.
- At least one account has an empty password denoted by * and another with a hashed password of lengths 5 or 6.
While the root account itself remains relatively safe due to its configuration, there remains a risk if an attacker gains access to other accounts that can escalate privileges to root.
The Risk Posed by Tiny-Cloud Images
Alpine has indicated that users of its tiny-cloud images, versions 3.18.11 through 3.24.3, should be particularly vigilant. These images come with a pre-configured 'alpine' user that utilizes an empty password field, making them easy targets. Systems become vulnerable as soon as any account with a 5 or 6 hash is created.
Steps for Mitigation
To address this serious vulnerability, Alpine has rolled out patches in recent updates: versions 3.21.10, 3.22.8, 3.23.8, and 3.24.4. Users are urged to take the following steps:
- Run the command apk upgrade -U -a to update the packages.
- Restart the OpenSSH daemon using rc-service sshd restart.
It is crucial to restart the daemon because just performing the upgrade does not automatically start the new version.
Monitoring for Suspicious Activity
After patching, systems must be monitored for any signs of unauthorized access. Administrators should search their logs, particularly /var/log/messages, for any suspicious entries like:
Accepted password for
Should any unauthorized login attempts with empty passwords be discovered, it is vital to treat the system as potentially compromised and take appropriate action.
Conclusion
The discovery of this vulnerability highlights the importance of security diligence within Linux environments. Immediate updates are essential for safeguarding systems, and administrators must remain vigilant to prevent potential exploitation. By prioritizing system security practices, users can protect their systems from such vulnerabilities.
