WORLDTECHDecade-old OpenSSH flaw can let attackers into some Alpine Linux devices without a password
A vulnerability that has existed for about a decade can allow attackers to log into some Linux devices without a password, a report says. Devices running some configurations of Alpine Linux are affected, and other distributions may be too.
Where the weakness lies
The weakness comes from the way OpenSSH, the code library that implements SSH connections, interacts with musl. musl is a lightweight alternative to libc, the standard C library, and it is used in Alpine rather than in most other Linux distributions.
The problem surfaces when OpenSSH runs on musl and does not use PAM, the pluggable authentication modules framework that handles user authentication and account-access checks. In that setup, the report indicates, an attacker can gain access to affected devices without a password.
Who could be affected
Devices running some configurations of Alpine Linux are affected. The report suggests that other distributions could be too, but the available information does not say which ones.
Alpine is a lightweight and widely used distribution, so the potential reach could be considerable, although the information provided gives no count of affected devices.
Open questions
- Which Alpine Linux configurations are affected, and which other distributions are involved?
- Has a fix or mitigation been published for the flaw?