OpenSSH released version 10.6p2 on 5 November with what its release notes call “a critical security workaround that affects Linux systems that use the musl libc and PAM disabled.”
The fix is for a password authentication bypass in sshd that applies “when built and run with PAM support disabled.” The OpenSSH team writes: “We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there.”
Alpine Linux, which is built on musl, published its own advisory the same day: “An attacker who can reach your SSH port can log in without knowing any password.” Alpine lists the conditions. The host runs its openssh-server package, which is built without PAM, or openssh-server-pam with UsePAM set to no. PasswordAuthentication is yes, which is the default. An account has an asterisk in its password field, as root does in the base image and as key-only users do. At least one other local account has a password hash. Alpine says releases 3.16 through 3.24 and edge are affected. No CVE identifier had been assigned when the advisory was written.
Alpine’s fixed releases are 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Its guidance includes a step that is easy to miss: “Upgrading the package alone does not replace the running daemon.” Administrators have to restart sshd after the update. Anyone who cannot update yet can set PasswordAuthentication to no and restart, after confirming that key login works.
Key-only accounts are normal on servers, so the precondition describes many real hosts. In our reading, the hosts most likely to be missed are container images and appliance firmware that run sshd on Alpine and rarely get a restart after a package update. The same restart gap showed up when Alpine said upgrading GitLab did not fix a flaw on its own instance, and our opinion on restricting management interfaces covers SSH ports too.
Source: OpenSSH 10.6p2 release notes, Alpine Linux security advisory
