A decade-old vulnerability named "sshole" allows hackers to SSH into Linux devices without a password. The flaw stems from the interaction between Open SSH and musl, a lightweight C library used in Alpine Linux. Attackers can exploit systems where Open SSH uses musl without PAM, and where a passwordless account has a password hash using SHA256 or SHA512.
When conditions are met, one connection grants access. Security firm Checkpoint confirmed that inputting over 256 characters in the password field triggers the exploit. The consequences are high, as attackers can gain access to accounts with doas or sudo rights, though root accounts remain safe under default settings.
Alpine maintainers warn that reachable accounts with password hashes are vulnerable. The vulnerability affects systems with passwordless accounts configured for certificate-based authentication. Users are advised to review their SSH configurations and account security settings immediately.
Source: Ars Technica · Summarized by HeadlinesBriefing