Decade-old *sshole flaw logs attackers into Alpine Linux devices without a password

Images

×

Photo of Dan Goodin arstechnica.com

A decade-old flaw nicknamed *sshole lets attackers log into certain Linux devices over SSH without knowing any password, Alpine Linux maintainers confirmed Thursday. "An attacker who can reach your SSH port can log in without knowing any password," they wrote. "It takes one connection, works every time, and needs no retries." The bug sits not in OpenSSH itself but in the interaction between OpenSSH and musl, the lightweight C library that Alpine uses instead of the standard glibc. Where OpenSSH is built without PAM — the usual authentication framework — and the target account is configured passwordless, an attacker who types more than 256 characters into the password field gets in. The account must also have a password hash salted with SHA256 or SHA512, as Checkpoint researchers explained: sshd borrows that account's salt, and without it the attack fails. Root accounts are safe under default settings, but any reachable account with doas or sudo rights can escalate from there. Alpine is the wrong distribution to have this problem. Its Docker Hub base image has more than one billion downloads, and it has long been the default choice for routers, smart TVs and industrial controllers — embedded devices that frequently cannot be updated at all. The discoverer of the flaw says OpenWRT is affected, along with the buildroot and yocto build systems, though this is unconfirmed. OpenWRT ships Dropbear rather than OpenSSH by default, which narrows but does not close the exposure. Shodan lists roughly 22 million systems with SSH open on port 22; only a fraction meet the exploit's conditions. Both OpenSSH and Alpine have shipped fixes, while musl developer Rich Felker maintains the fault lies with the caller, not the library — and that musl developers had wanted to change this mechanism for a while anyway. Every party patched its own code and assigned the blame elsewhere. The shipped firmware on the router in your hallway will never see any of these updates.