*sshole vulnerability allows password-free login to Linux

*sshole vulnerability allows attackers to infiltrate some devices running Alpine Linux without entering a password. The vulnerability, which emerged ten years ago, may also affect other Linux distributions. However, this requires using the same configuration.

Where does the *sshole vulnerability occur?

The vulnerability resides in the interaction between OpenSSH and musl. First of all, it is necessary to recognize these two names. OpenSSH is the code library that enables SSH connections. musl is a lightweight alternative to the libc library. It's pronounced like "muscle".

Most Linux distributions use libc. Alpine, on the other hand, prefers musl. Additionally, Alpine is known as a lightweight and widely used Linux distribution. That's why the *sshole vulnerability is especially important for systems running this distribution.

However, OpenSSH using musl should not use PAM. PAM is a framework that manages user authentication and account access controls. At the same time, other platforms using the same configuration may also be affected.

What are the conditions of the attack?

Two more conditions are required for a successful attack. First, there must be at least one user account in the system that can be accessed with a password. This password must be hashed with the SHA256 or SHA512 function.

Second, the target account must be configured without a password. To do this, "*" is written in the password field in the /etc/shadow file, which keeps the hash values ​​of passwords. Such accounts often use certificate-based authentication. So this setting is common for some account types.

Musl should be used together with OpenSSH

OpenSSH should not use PAM

There must be at least one account with a SHA256 or SHA512 hashed password

The target account's password field must contain "*"

What should those affected by the *sshole vulnerability do?

The attack works with a single connection and works every time. Moreover, it does not require retrying. For this reason, the risk can reach serious levels in systems that fully meet the conditions.

System administrators using the affected configuration should review their passwordless accounts and OpenSSH settings. This check is especially important on devices running Alpine Linux, because the vulnerability has been in the system for ten years.