A vulnerability discovered in the interaction between OpenSSH and musl, a lightweight C library used by Alpine Linux, enables attackers to gain unauthorized access to affected systems without authentication credentials.
The flaw requires several preconditions to be exploitable. Vulnerable systems must run OpenSSH with musl as the C library implementation and must not use PAM for authentication. Additionally, a system must have at least one user account with a password hashed using SHA256 or SHA512 functions, and the target account must be configured as passwordless by specifying an asterisk in the /etc/shadow file. Alpine maintainers confirmed that successful exploitation requires a single SSH connection attempt with more than 256 characters entered in the password field.
Alpine Linux, a lightweight distribution widely deployed in containers, routers, smart televisions, and industrial controllers, appears to be the primary affected platform. The Docker Hub base image for Alpine has exceeded 1 billion downloads, suggesting substantial exposure. Security researchers estimate approximately 22 million systems worldwide have SSH accessible on standard ports, though only a fraction meet the specific conditions necessary for exploitation.
Responsibility for the vulnerability’s origin remains disputed among developers. OpenSSH released patches Thursday, stating the root cause exists outside the SSH daemon itself. Musl maintainers similarly contend the issue stems from incorrect usage by calling software rather than a defect within musl. Patches have been released by both Alpine and OpenSSH. Other affected packages may include OpenWRT, buildroot, and yocto, though confirmation is pending. No official CVE designation has been assigned to the vulnerability at this time, and affected users are advised to immediately verify their system configurations and apply available updates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI