CVE-2019-5021

Vulnerability

The Official Alpine Linux Docker images (versions 3.3 through 3.9 and edge) contain a NULL password for the root user in /etc/shadow, a regression introduced in December 2015 [1]. This results in a blank sp_pwdp field, causing the system to treat the root account as having no password rather than locked [1]. Affected versions include all releases from v3.3 onward, with v3.5, v3.4, and v3.3 being end-of-life and still vulnerable [2].

Exploitation

An attacker must first gain shell access to the container (e.g., through an unrelated vulnerability) or have local user access. If the shadow or linux-pam packages are installed, the system may use /etc/shadow for authentication, and the empty root password allows the attacker to switch to the root user without providing a password [2]. No network-based remote exploitation is possible without prior access.

Impact

Successful exploitation results in privilege escalation from an unprivileged user to root within the container, granting full control over the container's resources and data [2]. The CVSSv3 score is 9.8 (Critical) due to the potential for complete compromise of confidentiality, integrity, and availability [1].

Mitigation

Fixed releases are available as of 7 March 2019: edge (20190228 snapshot), v3.9.2, v3.8.4, v3.7.3, and v3.6.5 [2]. Users of older or EOL versions (v3.3 through v3.5) can apply a workaround by adding the following line to their Dockerfile:

RUN sed -i -e 's/^root::/root:!:/' /etc/shadow

This disables the root password by replacing the empty field with !. Alternatively, avoid installing linux-pam or shadow packages in the container [2].