Alpine patches SSH login bypass that can expose key-only accounts
Editorial Team
••📖6 min read
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Certain password-disabled accounts are exposed when a vulnerable server still accepts password authentication.
Alpine has supplied fixes back to version 3.16; administrators must restart sshd after updating.
Some tiny-cloud instances can become vulnerable to root access after another account receives a password.
Alpine Linux, a lightweight Linux distribution built around the musl C library and BusyBox, warned on November 5 that attackers can enter certain accounts without knowing a password. The bypass is reachable through OpenSSH, the software providing SSH logins and SFTP file transfers. Alpine has released patched packages, but updating alone leaves the running SSH server vulnerable until it is restarted.
When a key-only account becomes reachable
Alpine's security advisory describes a specific combination of conditions. An attacker must be able to reach the SSH port and know the name of an account whose stored password field is *. At least one other local account must have a $5$ or $6$ password hash, and the server must permit password authentication.
The affected configurations are Alpine's standard openssh-server package, built without PAM authentication support, and openssh-server-pam when configured with UsePAM no. Under these conditions, Alpine says, a single connection using a password 257 to 1024 bytes long succeeds without retries. The attacker does not need the other account's password.
That makes the distinction between an account setting and a server setting consequential. A user intended to log in only with a key can have * in its password field while the server continues accepting password attempts. Alpine says password authentication is enabled by OpenSSH's default unless changed.
Using openssh-server-pam with UsePAM yes, or setting PasswordAuthentication no, blocks this bypass. Containers that do not run sshd are outside this attack path, as are systems without any $-style password hash. Alpine also distinguishes accounts locked with ! in their password field: those cannot log in with either a password or a key, according to the advisory.
The root account has shipped with a * password field in Alpine's base image since about version 3.16. OpenSSH's default PermitRootLogin prohibit-password protects it against direct password access; PermitRootLogin yes removes that protection. A successful login to another account can still lead to root if that account can elevate privileges through .
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
doas
Alpine also identifies directory-service users supplied through musl-nscd as potentially affected because they have no shadow entry.
Musl’s SHA-512 crypt source documents the asterisk returned on error. Highlighted excerpt courtesy of the issue website. Source: *sshole.
Why the password check accepts an error
Without PAM, sshd, the SSH server daemon, checks a password by calling the C library's crypt() function and comparing its output with the stored password field. When that field is too short to contain a salt, the server borrows a salt from another account, Alpine explains.
For an input longer than 256 bytes, musl's function returns * to indicate an error. That matches the stored field of the password-disabled account, causing the check to succeed. The other account's hash supplies a prerequisite for the attack rather than a secret the attacker must obtain.
Portable OpenSSH 10.6p2, released November 5, contains a critical workaround for Linux systems using musl with PAM disabled, according to the upstream release announcement. The OpenSSH developers place the root cause outside sshd, while acknowledging that the bypass can be exploited through the daemon and prevented there.
Alpine says its stable-branch packages carry a patch for the same problem. An older upstream version number therefore does not, by itself, establish whether an Alpine installation remains vulnerable.
The OpenSSH team also used the announcement to explain a change in release policy. It said it would issue fixes more frequently after seeing security bugs identified by AI tools independently rediscovered by other researchers, raising concern that adversaries could find them too. The announcement does not say this particular bypass was discovered using AI.
Cloud exposure can change after provisioning
Alpine says its official tiny-cloud qcow2, VHD and AMI images from 3.18.11 through 3.24.3 contain an alpine account with a * password field and passwordless doas. These images are safe at first boot, according to the advisory, but become exploitable when a $6$ hash appears—for example, after an administrator sets a console password or user-data creates a user with hashed_passwd.
An attacker can then obtain a shell as alpine and use doas to become root. Intended key-only access therefore does not settle an instance's exposure: a later change to another account can supply the missing condition.
Images built from 3.21.10, 3.22.8, 3.23.8 and 3.24.4 onward include the fixed package. Running instances based on earlier images require action. Alpine distinguishes tiny-cloud images from images configured through cloud-init, which sets PasswordAuthentication no and blocks this attack.
Update the running server, then assess prior access
Alpine reports the flaw in every release it checked from 3.21 through 3.24 and edge, as well as older releases from 3.16 through 3.20. It has supplied patched packages even for releases outside regular support; 3.21 reached its support deadline on November 1.
The advisory identifies these fixed package versions:
Alpine branch
Fixed OpenSSH package
edge
10.6_p2-r0
3.24
10.3_p1-r2
3.23
10.2_p1-r1
3.22
10.0_p1-r11
3.21
9.9_p2-r1
3.20
9.7_p1-r6
3.19
9.6_p1-r3
3.18
9.3_p2-r4
3.17
9.1_p1-r7
3.16
9.0_p1-r6
Alpine instructs administrators to update with apk upgrade -U -a and then run rc-service sshd restart. Installing the package does not replace the running daemon. Administrators unable to update can instead disable password authentication and restart the service. Before changing access settings, they should confirm that key login works and keep the current session open while testing a new connection.
Configuration details matter: Alpine's default configuration reads drop-in files from version 3.19 onward, while older releases ignore them. The advisory also gives instructions for changing the main configuration, checking it and verifying that the effective setting is passwordauthentication no. The issue website likewise directs users to update or disable password logins.
Closing the bypass leaves a separate question: whether an exposed machine has already accepted an unauthorized login. Alpine advises checking /var/log/messages for Accepted password for entries involving accounts with no password, then reviewing doas activity, new users, files and authorized keys. If a login cannot be ruled out, its advice is to treat the machine as compromised.
The advisory had no assigned CVE identifier at the time of writing and provides no count of exposed or compromised machines. Its account and configuration checks establish which systems need action, rather than how widely the bypass has been exploited.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
