Unchecked MKPASSWD Implementations Created Rootless Login Debian Images

Summary

(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and below contains a fail-open password validation flaw in the Alpha user and Root user password loops of Shell/debian-minbase-install.sh (lines 788 and 851 in v1.2.0).

The installer hashes the entered passwords with (shown for the Alpha user loop; the Root loop is identical):

TARGET_PASSWORD_USER="$(printf -- "%s" "$____password" \
                        | mkpasswd --method=yescrypt --stdin \
                        2> /dev/null)"

followed by an unconditional break command. The return value of mkpasswd is never checked and its error output is discarded. Hence, on any host whose mkpasswd cannot produce yescrypt hashes (e.g. an older Debian release where the makepasswd package's mkpasswd shadows the whois package's mkpasswd, or a host with an old or incompatible libxcrypt), the command fails silently and the loop accepts an empty string as the password hash.

Details

The issue is fixed in v1.2.1, published on 2026-08-27 ahead of public disclosure. The
validation loop now accepts a hash only if it begins with the $y$ prefix. Any other value aborts the build with an explicit diagnostic listing the usual causes. A pre-flight check additionally verifies that the host's mkpasswd supports yescrypt before any part of the build starts.

The patch is available at:

• https://github.com/ChewKeanHo/software-actualizer/commit/50a0932ac705635d9af62955c353e7c6df003a61.patch

Impact

The empty hash is written into the built image: both the root account and the alpha user account created by the installer receive an empty /etc/shadow password field, permitting password-less login on every image built on an affected host.

The CVSS 3.1 base score is: 7.9 (High) — AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C

The CWEs are:

• CWE-636: Not Failing Securely ("Failing Open") — primary defect
• CWE-252: Unchecked Return Value — secondary defect

Credits

• Reporter: An undisclosed and unknown entity disqualified from CVD.
• Coordinator: Alice Xiang Yu Xuan (湘渝萱)
• Analysis, Patch Development, and Production Deployment: (Holloway) Chew, Kean Ho

References

• https://github.com/ChewKeanHo/software-actualizer/releases/tag/v1.2.1
• https://github.com/ChewKeanHo/software-actualizer/commit/50a0932ac705635d9af62955c353e7c6df003a61.patch
• https://github.com/ChewKeanHo/software-actualizer/blob/v1.2.0/Shell/debian-minbase-install.sh#L788
• https://cwe.mitre.org/data/definitions/636.html
• https://cwe.mitre.org/data/definitions/252.html
• https://doi.org/10.5281/zenodo.22169659