A critical security flaw discovered in the interaction between OpenSSH and the musl C library allows attackers to log into Linux devices without a password. The vulnerability, dubbed *sshole by its discoverer, affects certain configurations of Alpine Linux and potentially other distributions that share similar technical setups.
Security researchers from Checkpoint and Detectify have highlighted the severity of the issue. The flaw enables unauthorized access by exploiting how the SSH daemon handles authentication for passwordless accounts. This means an attacker with network access to the SSH port can bypass security measures entirely.
How the *sshole Flaw Works
The vulnerability relies on a specific combination of software components. It occurs when OpenSSH runs on a system using musl, a lightweight alternative to the standard libc library. This setup is common in Alpine Linux but may exist in other environments. Crucially, the system must not use Pluggable Authentication Modules (PAM) for handling user authentication.
Two additional conditions are required for the attack to succeed. First, the target system must have at least one user account with a password hashed using SHA256 or SHA512. Second, the specific account targeted must be configured as passwordless, typically indicated by an asterisk in the /etc/shadow file. This configuration is standard for accounts that use certificate-based authentication.
To exploit the flaw, an attacker inputs more than 256 characters into the password field. According to Alpine maintainers, this method works every time and requires no retries. Checkpoint researchers noted that the SHA256 or SHA512 hash is essential because the SSH daemon borrows the account’s salt. Without this salt, the attack fails.
Widespread Impact and Patching
The potential reach of this vulnerability is significant. The Docker Hub base image for Alpine has been downloaded over one billion times. Alpine is widely used in routers, smart TVs, industrial controllers, and embedded devices, many of which are difficult to update. It is also increasingly common in desktops, servers, and container images.
While not every system with SSH open is vulnerable, the ease of testing makes scanning for affected devices straightforward. Detectify reported that Shodan lists approximately 22 million systems with SSH open on port 22. Although only a fraction meet the specific prerequisites, the low barrier to entry for attackers poses a substantial risk.
OpenSSH issued an update on Thursday to address the issue. The project stated that the root cause lies outside the sshd daemon but is exploitable through it. Musl developer Rich Felker described the issue as an erroneous use by the caller rather than a bug in musl itself. He confirmed that changes to the mechanism are planned for an upcoming release.
Alpine Linux has also released a patch. Users are advised to install updates from both Alpine and OpenSSH immediately. There is currently no CVE designation for this vulnerability. While the exact scope of affected packages remains under investigation, OpenWRT, buildroot, and Yocto have been mentioned as potentially impacted, though confirmation is pending.
Source: Ars Technica
