Affected Systems

OpenSSH versions prior to 10.6p2 on Alpine Linux (all releases from 3.16 onward) and other musl-based systems (OpenWrt, Buildroot, Yocto). Affects systems with openssh-server built without PAM, PasswordAuthentication enabled (default), and at least one account with no password (*) alongside another account with a $5$ or $6$ password hash. glibc-based Linux and PAM-enabled configurations are not affected.

Exploitation Status

No active exploitation reported. Technical details and attack conditions are publicly disclosed. Exploitation requires network access, valid account name, and a password string between 257-1,024 bytes. Attack succeeds on every attempt with single connection.

Business Impact

Critical authentication bypass allows remote attackers to log in to password-less accounts (SSH key-only users, root with *, directory service users via musl-nscd) on Alpine Linux servers. Alpine cloud images with tiny-cloud (3.18.11-3.24.3) are particularly exposed: the alpine user has passwordless doas, enabling immediate privilege escalation to root once any $6$ hash exists on the system. Containers not running sshd and systems with PasswordAuthentication no are not affected.

Urgency

🔴 Immediate

Recommended Actions

  • Update Alpine Linux to point releases 3.21.10, 3.22.8, 3.23.8, 3.24.4 or later, or run 'apk upgrade -U -a' followed by 'rc-service sshd restart' to apply OpenSSH 10.6p2
  • If immediate patching is not possible, set PasswordAuthentication no in /etc/ssh/sshd_config, verify with 'sshd -t', and restart sshd after confirming SSH key authentication works
  • Search /var/log/messages for 'Accepted password for' entries matching accounts with no password (alpine, root, key-only users) to detect potential compromise
  • Review doas usage, recently created users, new files, and authorized_keys on exposed systems; treat any unexplained password login to password-less accounts as full compromise
  • Audit other musl-based systems (OpenWrt with OpenSSH, Buildroot, Yocto) for the same vulnerability conditions and apply vendor patches or disable PasswordAuthentication