A security vulnerability designated *sshole has been identified affecting certain configurations of Alpine Linux and potentially other distributions running OpenSSH with musl libc. The flaw allows unauthorized remote access via SSH when several specific conditions align on a target system.
Exploitation requires the presence of at least one user account with a password hashed using SHA256 or SHA512 functions, combined with a separate account configured as passwordless through a wildcard entry in the system’s shadow file. Additionally, the vulnerable system must run OpenSSH without PAM (Pluggable Authentication Modules) enabled. When these prerequisites exist, an attacker can gain access to a passwordless account by entering more than 256 characters in the password field, bypassing authentication entirely.
Alpine Linux, known for its lightweight design, has achieved widespread adoption across multiple computing environments including containers, embedded devices, routers, and smart TVs. The Docker Hub base image for Alpine has been downloaded over 1 billion times, and the distribution is commonly used in systems that may be difficult or impossible to update. Given this distribution footprint, security researchers estimate that the vulnerability potentially threatens large numbers of deployed systems despite specific exploitation prerequisites.
Responsibility for the vulnerability remains disputed among parties involved. OpenSSH released a patch Thursday, stating the root cause lies outside sshd itself, though the issue is exploitable through it. Musl developers counter that the vulnerability results from improper usage by the calling application rather than a defect in musl itself, though they indicated plans to implement changes to the underlying mechanism in a future release. Alpine has also released updates in response.
The vulnerability’s scope beyond Alpine remains unclear. Initial reports suggest other systems including OpenWRT, buildroot, and yocto may be affected, though confirmation is pending. Security researchers note that while millions of systems expose SSH on standard ports, only those meeting the specific configuration requirements face actual risk. No CVE designation has been assigned to the vulnerability. Both Alpine and OpenSSH patches should be installed immediately on potentially affected systems.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI