Alpine Linux SSH Flaw Exposes Millions of Embedded Devices to Password-Free Breach

Alpine Linux and other systems running OpenSSH without PAM authentication are vulnerable to a critical flaw that permits password-free remote login. The vulnerability requires a specific configuration: passwordless accounts with SHA256 or SHA512 password hashes alongside at least one password-authenticated user. When an attacker inputs over 256 characters in the password field, the system authenticates them to the passwordless account without requiring credentials.

The flaw stems from interaction between OpenSSH, musl libc, and Alpine's authentication setup. Alpine's Docker base image has exceeded 1 billion downloads, and the distribution remains standard in routers, smart TVs, industrial controllers, and container environments. Security firm Detectify estimates around 22 million systems expose SSH ports publicly. While only a fraction meet exploitation requirements, attackers can rapidly scan and target vulnerable machines.

Both OpenSSH and Alpine released patches Thursday. OpenSSH maintained the root cause lies outside sshd, while musl's developer suggested caller misconfiguration. The scope of affected systems beyond Alpine remains unclear, though OpenWRT reportedly faces similar risks.