A decade-old vulnerability dubbed *sshole can let an attacker log in to some Linux systems over SSH without a password. It affects certain Alpine Linux configurations and may affect other distributions that use the same setup. The flaw arises from an interaction between OpenSSH and musl, a lightweight alternative to the libc library, when OpenSSH is used without PAM, the framework that handles authentication and account-access checks.
Exploitation requires a system with an accessible account whose password uses a SHA256 or SHA512 hash, and a target account configured as passwordless in /etc/shadow. An attacker who can reach the SSH port can then enter more than 256 characters in the password field to log in; Alpine’s maintainers said one connection is enough and retries are unnecessary. Check Point researchers said sshd borrows the account’s salt, which makes the hash type relevant, and their testing indicated that the account must be active. They also reported that root accounts are protected under the default PermitRootLogin prohibit-password setting, although an attacker who reaches an account with doas or sudo rights could still become root.
Alpine is used in container images, desktops, servers and embedded devices, including routers, smart TVs and industrial controllers. Its Docker Hub base image has more than 1 billion downloads, and many embedded devices may be difficult or impossible to update. Detectify cited Shodan as listing around 22 million systems with SSH open on port 22. Only a fraction would meet the exploit conditions, but the article said scanning for vulnerable systems should take little effort or time.
OpenSSH and Alpine have issued updates, but the root cause remains disputed. OpenSSH said the cause is outside sshd but can be exploited through it; musl developer Rich Felker said musl was not at fault and described possible changes to the mechanism in a future release. The discoverer said OpenWRT is affected, although it uses Dropbear by default for SSH; claims that Buildroot and Yocto are affected had not been confirmed. Users of systems combining musl and OpenSSH should investigate whether they are affected and install both Alpine and OpenSSH patches where applicable. No CVE designation was known at publication.