A vulnerability identified as *sshole has been discovered that permits unauthorized access to Linux systems running certain configurations of Alpine Linux and potentially other distributions. The flaw exists in the interaction between OpenSSH and musl, a lightweight alternative to the standard libc library used by Alpine. The vulnerability requires that OpenSSH not use PAM (pluggable authentication modules) for authentication handling.
Successful exploitation requires multiple specific conditions to be present simultaneously. Systems must have at least one user account with a password hashed using SHA256 or SHA512 functions, and the target account must be configured as passwordless by specifying an asterisk in the password field of the /etc/shadow file. When these conditions align, attackers can gain access by entering more than 256 characters in the password field during login attempts. According to Alpine maintainers, the attack succeeds reliably on the first connection attempt without requiring retries.
The vulnerability poses a significant threat due to Alpine’s widespread adoption across multiple platforms and use cases. The Docker Hub base image for Alpine has accumulated over 1 billion downloads. Alpine is commonly deployed in routers, smart televisions, industrial controllers, and other embedded devices that may not receive regular security updates. Additionally, Alpine has gained traction in desktop and server environments and is frequently used in container images. Security researchers identified approximately 22 million systems with open SSH ports, though only a fraction would meet the specific conditions necessary for exploitation.
The responsibility for the vulnerability remains disputed among developers. OpenSSH released an update and indicated that the root cause lies outside its software, though it is exploitable through it. Musl developers contend the issue stems from incorrect usage by calling applications rather than from musl itself, though they have indicated plans to implement changes to the underlying mechanism in an upcoming release. Alpine has also issued patches. Other affected systems may include OpenWRT, buildroot, and yocto, though confirmation is pending for some.
Organizations using systems with both musl and OpenSSH are advised to investigate their exposure immediately and apply available patches from both Alpine and OpenSSH. No CVE designation has been assigned to the vulnerability at this time.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI