CVE-2019-5021
📋 TL;DR
This vulnerability allows attackers to log into Alpine Linux Docker containers as root with no password. It affects systems using affected Alpine Linux Docker images (v3.3+) where authentication relies on the system shadow file, such as those using Linux PAM.
💻 Affected Systems
- Official Alpine Linux Docker images
📦 What is this software?
Docker Alpine by Gliderlabs
Leap by Opensuse
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Full container compromise leading to host escape, data theft, lateral movement, and complete system takeover.
Likely Case
Unauthorized root access to containers, enabling privilege escalation, data exfiltration, and persistence.
If Mitigated
Limited impact if containers run as non-root users, have network restrictions, or use alternative authentication methods.
🎯 Exploit Status
Simple passwordless login via SSH or other authentication services. No special tools required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Alpine Linux v3.9.5 and later
Vendor Advisory: https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html
Restart Required: Yes
Instructions:
1. Update Docker images: `docker pull alpine:latest` or specific version like `alpine:3.9.5`. 2. Rebuild containers using updated base image. 3. Redeploy containers.
🔧 Temporary Workarounds
Set root password manually
linuxManually set a strong password for root user in container
docker exec -it <container_name> passwd root
Disable root login
linuxPrevent root from logging in via SSH
echo 'PermitRootLogin no' >> /etc/ssh/sshd_config
service sshd restart
🧯 If You Can't Patch
- Run containers as non-root user using USER directive in Dockerfile
- Implement network segmentation and restrict container access to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Check if container uses Alpine Linux v3.3-v3.9.4: `docker exec <container_name> cat /etc/alpine-release`. Then test SSH login with empty password: `ssh root@container_ip`.Check Version:
docker exec <container_name> cat /etc/alpine-releaseVerify Fix Applied:
Verify Alpine version is v3.9.5+: `docker exec <container_name> cat /etc/alpine-release`. Test SSH login with empty password should fail.📡 Detection & Monitoring
Log Indicators:
- Successful SSH logins as root without password authentication in auth.log
- Multiple failed password attempts followed by successful login
Network Indicators:
- SSH connections to containers from unexpected sources
- Unusual outbound connections from containers
SIEM Query:
source="auth.log" "Accepted password for root" OR "Accepted publickey for root" | where password=""🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html
- http://www.securityfocus.com/bid/108288
- https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html
- https://security.netapp.com/advisory/ntap-20190510-0001/
- https://support.f5.com/csp/article/K25551452
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html
- http://www.securityfocus.com/bid/108288
- https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html
- https://security.netapp.com/advisory/ntap-20190510-0001/
- https://support.f5.com/csp/article/K25551452
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782
