Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

If your Linux systems use Alpine, musl, and OpenSSH without PAM, they are now vulnerable to unauthenticated remote access.

A newly disclosed vulnerability, dubbed "*sshole," allows unauthenticated attackers to gain SSH access to specific Linux device configurations by sending a specially crafted password. The flaw affects systems using Alpine Linux or potentially other distributions that combine OpenSSH with the musl C library, specifically when PAM authentication is not used. For exploitation, the target system must also have a passwordless account configured (indicated by a '*' in the /etc/shadow file) and use SHA256 or SHA512 password hashing. Attackers can bypass authentication for these passwordless accounts by providing over 256 characters in the password field during an SSH login attempt. Alpine and OpenSSH have released patches to address the vulnerability. The discoverer of the flaw indicated that OpenWRT, Buildroot, and Yocto might also be affected, though confirmation is pending.

The *sshole vulnerability highlights a critical interaction flaw between OpenSSH and the musl C library, particularly in configurations that eschew traditional PAM authentication. This situation exposes a decade-old weakness that could be exploited on a wide range of devices, from embedded systems to containers, many of which may have delayed or no patching capabilities. The discovery underscores the complexity of securing specialized Linux distributions and the potential for seemingly minor library choices to introduce significant security risks.

The broad download numbers for Alpine's Docker image and the prevalence of SSH on internet-connected devices suggest that a substantial number of systems could be at risk, despite the specific configuration requirements. This incident prompts a re-evaluation of default security postures for lightweight Linux distributions and raises questions about the ongoing maintenance and security patching of embedded systems. Organizations should proactively audit their environments for these specific configurations and prioritize patching to mitigate potential widespread exploitation.