{"id":57,"date":"2026-11-09T08:08:36","date_gmt":"2026-11-09T08:08:36","guid":{"rendered":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/alpine-linux-and-openssh-patch-flaw-thats-as-bad-as-it-can-get-zdnet\/"},"modified":"2026-11-09T08:08:36","modified_gmt":"2026-11-09T08:08:36","slug":"alpine-linux-and-openssh-patch-flaw-thats-as-bad-as-it-can-get-zdnet","status":"publish","type":"post","link":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/alpine-linux-and-openssh-patch-flaw-thats-as-bad-as-it-can-get-zdnet\/","title":{"rendered":"Alpine Linux and OpenSSH patch flaw that’s as bad as it can get – ZDNET"},"content":{"rendered":"
\"Alpine<\/div>\n<\/p>\n

ZDNET\u2019s key takeaways<\/p>\n

An ancient bug is affecting Alpine Linux and a few other Linux distros.\u00a0<\/p>\n

It\u2019s about as bad as it can get. <\/p>\n

You must patch ASAP, and then restart the patched software.<\/p>\n

The perfect nightmare scenario for a Linux server is when all an attacker needs to do is reach the server\u2019s Secure Shell (SSH) port, waltz right in, and take it over. That\u2019s what happened to Alpine Linux, the popular, lightweight Linux server. Adding insult to injury, this happened only days after Alpine Linux dodged a security hole-sized bullet to its GitLab implementation.\u00a0<\/p>\n

Also: Linux Mint 27 arrives next month, and I like it already: What to expect<\/p>\n

How the attack works<\/p>\n

As security engineer Gregory Bryant explained in his LinkedIn post:<\/p>\n

Most authentication bypasses come from complex logic chains, but yesterday\u2019s Alpine Linux OpenSSH vulnerability (CVE-2026-123158) comes down to a single character: *.\u201d<\/p>\n

If you run Alpine Linux (or another musl-based distro) with the default openssh-server package (no Pluggable Authentication Modules (PAM)) and PasswordAuthentication enabled, an attacker can log into password-disabled, or key-only accounts simply by sending a password between 257 and 1024 bytes long.<\/p>\n

That\u2019s it. That\u2019s all.\u00a0<\/p>\n

Alpine Linux isn\u2019t the only operating system that uses musl, a lightweight version of the standard C library (libc). Other operating systems that use musl and are potentially vulnerable include Ad\u00e9lie Linux; Void Linux; Sabotage Linux; OpenWrt, an Android variant,\u00a0 and the Yocto Project, which is used to build embedded Linux distributions.\u00a0<\/p>\n

Also: This clever banking scam keeps phishing by faking its own demise<\/p>\n

Wind River, which produces the commercial embedded Linux distro, Wind River Linux, is also looking into the issue. A company representative told me, \u201cWind River takes security seriously. We are actively reviewing the reported vulnerability and assessing its potential impact. We will take appropriate action as needed.\u201d<\/p>\n

Behind the scenes, when OpenSSH is built without PAM, it verifies passwords by hashing the password attempt using the C library\u2019s crypt() function. It then compares the result to the account\u2019s stored password field. So far, so good.<\/p>\n

But when a key is longer than 256 bytes, musl\u2019s crypt() function returns the string * as an error indicator. That is also what the password field holds for any account with no password, such as a key-only account. Thus, the \u201chash\u201d matches and the login succeeds, and the attacker walks in.\u00a0<\/p>\n

Also: The new Cutefish Linux distro might be the best MacOS clone around<\/p>\n

To exploit it, an attacker only needs the name of such an account. The attacker also needs at least one other account on the machine with a 5 or 6 password hash, and then to send a password of 257 to 1,024 bytes. According to Alpine, one user with a password is enough to make every passwordless account accessible.<\/p>\n

In Linux systems that use glibc\u2019s crypt(), which is almost all of them, the same attempt would return NULL on error, which sshd already rejects, so Debian, Ubuntu, Fedora, etc., aren\u2019t affected.\u00a0<\/p>\n

According to *sshole, the group that uncovered the problem, this is a side effect that has been hiding since 2016.<\/p>\n

Who\u2019s exposed<\/p>\n

Alpine said every release it checked is affected: 3.21 through 3.24, edge, and the older 3.16 to 3.20 branches. Exposure requires the following:<\/p>\n

The openssh-server package, which is built without PAM, or openssh-server-pam with UsePAM no.<\/p>\n

PasswordAuthentication set to yes, which is the OpenSSH default.<\/p>\n

An account with * as its password field, and another account with a 5 or 6 hash.<\/p>\n

Root is not directly exposed in most cases. It has shipped as root:* in the base image since about Alpine 3.16, but OpenSSH\u2019s default PermitRootLogin prohibit-password blocks it. Another account that can become root, for example through doas, still gives an attacker a route to root.<\/p>\n

Alpine singled out its official tiny-cloud images, versions 3.18.11 through 3.24.3, as especially vulnerable. These ship with an alpine user with a * password field and passwordless doas. They are safe on first boot but become exploitable once any 6 hash exists on the machine. That can happen when an administrator sets a console password or when user data adds a user with a hashed password, which means, essentially, all of them.\u00a0<\/p>\n

Alpine said these are not affected:<\/p>\n

Containers that do not run sshd.<\/p>\n

Systems with password authentication disabled.<\/p>\n

Systems using openssh-server-pam with UsePAM yes.<\/p>\n

Locked accounts with! in the password field.<\/p>\n

Cloud images configured through cloud-init, which writes PasswordAuthentication no.<\/p>\n

The fix<\/p>\n

Alpine released 3.21.10, 3.22.8, 3.23.8 and 3.24.4 on Thursday, with the OpenSSH fix among the security changes. It also published fixed packages for each release back to 3.16. Alpine 3.21 reached end of support on Nov. 1. <\/p>\n

The just-released OpenSSH 10.6p2 avoids the problem in sshd. Alpine\u2019s stable branches carry a patch for the same problem. You should run apk upgrade -U -a and then restart the daemon with rc-service sshd restart. Alpine stressed that upgrading the package does not replace the running daemon. Anyone who cannot update should set PasswordAuthentication no and restart sshd, after confirming that key login works.<\/p>\n

Also: Maze Linux is the best security-focused distro I\u2019ve ever tested<\/p>\n

To check for an attack, Alpine told administrators to search \/var\/log\/messages for \u201cAccepted password for\u201d lines that name an account with no password. It also advised reviewing dedicated OpenBSD application subexecutor (doas) use and recently created users, files, and authorized keys. \u201cIf you cannot rule out a login, treat the machine as compromised.\u201d Just what you wanted for your weekend, I know, but here we are.\u00a0<\/p>\n

\t\t\t\t\t\t\tSteven Vaughan-Nichols<\/p>\n

\t\t\t\t\t\t\tSenior Contributing Editor\t\t\t\t\t\t<\/p>\n

\t\t\t\t\t\t\t\t\t\t\tSteven J. Vaughan-Nichols is a freelance writer and technology analyst. Besides ZDNET, he works with ComputerWorld, The Register, The New Stack, TechStrong, and Cathey Communications. He doesn’t own stocks or other investments in any technology company.<\/p>\n

\t\t\t\t\t\tSee full bio\t\t\t\t\t<\/p>\n\n
Source credits: <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

ZDNET\u2019s key takeaways An ancient bug is affecting Alpine Linux and a few other Linux distros.\u00a0 It\u2019s about as bad as it can get. You must patch ASAP, and then restart the patched software. The perfect nightmare scenario for a Linux server is when all an attacker needs to do is reach the server\u2019s Secure Shell (SSH) port, waltz right … <\/p>\n

Read More<\/a><\/div>\n","protected":false},"author":1,"featured_media":58,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.zdnet.com\/wp-content\/uploads\/sites\/3\/GettyImages-879472452.jpg","fifu_image_alt":"","footnotes":""},"categories":[16],"tags":[],"class_list":["post-57","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/posts\/57","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/comments?post=57"}],"version-history":[{"count":0,"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/posts\/57\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/media\/58"}],"wp:attachment":[{"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/media?parent=57"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/categories?post=57"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/instabox-d.sheep-mine.ts.net\/index.php\/wp-json\/wp\/v2\/tags?post=57"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}