Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into devices with no password.

The vulnerability exists in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library that, unlike most other Linux distributions, is used in Alpine. Further, OpenSSH using musl (pronounced muscle) must not use PAM (pluggable authentication modules), a framework that handles user authentication and account-access checks. Alpine is a lightweight, widely used Linux distribution. Other platforms may be affected if they use the same configurations.

One connection, works every time, needs no retries

There are two other conditions necessary for successful exploitation. First, a system must have at least one user account that’s accessible using a password that is hashed using the SHA256 or SHA512 functions. Second, the target system account must be configured to be passwordless, by way of specifying a “*” in the password field in /etc/shadow, the Linux file where password hashes are stored. Passwordless accounts are commonly used for accounts that use certificate-based authentication. This setting is common for certain types of accounts.

When all the conditions are met, the consequences are high.

“An attacker who can reach your SSH port can log in without knowing any password,” Alpine maintainers said Thursday. “It takes one connection, works every time, and needs no retries.”

When logging into a passwordless account, the attacker can gain access by inputting more than 256 characters in the password field.

Security firm Checkpoint said that the use of the SHA256 or SHA512 functions “matters because sshd borrows that account’s salt. Without it, the attack fails.”  Company researchers said their testing also showed that the account must be active, not just hold a hash. Checkpoint further reported that root accounts are safe under the default PermitRootLogin prohibit password setting, though reachable accounts with doas or sudo rights can still become root.

Despite the prerequisites, *sshole—the vulnerability name given by the person who discovered it—likely threatens large numbers of systems. The Docker Hub base image for Alpine has more than 1 billion downloads. Alpine has long been popular in routers, smart TVs, industrial controllers, and other types of embedded devices, many of which can’t be easily updated, if at all. More recently, Alpine has been adopted for use in desktops and servers. Alpine is also used in many container images.

According to security firm Detectify, Shodan lists around 22 million systems with SSH open on port 22. Only a fraction meet the conditions necessary for exploitation, but given the ease and speed of testing each one, locating vulnerable devices won’t require much effort or time.

It’s not entirely clear where the vulnerability resides. OpenSSH, which issued an update Thursday, said: “We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there.” Musl developer Rich Felker, meanwhile, wrote: “It is my position that this is not a bug in musl just an erroneous use by the caller.” Felker went on to say that musl developers have wanted to make changes to the mechanism “for a while now” and planned to do so in an upcoming release. Alpine has also issued an update.

It’s not yet known what other packages may be vulnerable. The person who discovered *sshole said OpenWRT is affected, but by default, that OS uses the Dropbear package, not OpenSSH, for SSH connections (though maintainers provide instructions for installing the latter). The discoverer also names the packages buildroot and yocto as being affected, but that isn’t yet confirmed.

Despite the uncertainty, anyone using a Linux system that uses both musl and OpenSSH should take time to immediately investigate if they’re affected. A good starting point is here. Both Alpine and OpenSSH patches should be installed on all affected systems. There is no known CVE designation for the vulnerability.

1. After Texas' blue wave, what happens to Elon Musk and SpaceX?

2. Uranium cubes reveal why the German nuclear project failed

3. Hackers exploited iOS and Android flaws to infect phones

4. VMware releases vSphere Express for virtualization on up to 128 cores

5. Kalshi court losses pile up as judges refuse to block state gambling laws