Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

What happened

Researchers found a decade-old vulnerability (a weak spot in code that hackers can abuse). It affects devices running some setups of Alpine Linux, and maybe other Linux versions too. The problem comes from how OpenSSH, the tool that makes secure remote connections, works with musl, a small replacement for the standard C library used in Alpine. An attacker who can reach the SSH port may be able to log in without knowing the password.

Key facts

• The bug is about 10 years old.
• Only systems that use OpenSSH with musl, and do not use PAM, are at risk.
• One connection is enough, and it works every time, according to the Alpine maintainers.
• The attack needs an account with a password hashed using SHA256 or SHA512.
• The target account must be set to passwordless by putting "*" in the password field of /etc/shadow.

Key terms

SSH is a secure way to control a computer over a network. PAM is a system that checks who a user is and whether they may enter an account. A hash is a scrambled form of a password. The /etc/shadow file on Linux stores these hashes. Passwordless accounts are often used with certificate-based login, where a digital key replaces a typed password.

Why it matters

When all the conditions are met, the risk is high. An attacker could get into an account without any password. Checkpoint said root accounts are safe under the default PermitRootLogin setting, but users with doas or sudo rights could still gain root access. Systems that match these setups should be checked quickly.

What to watch

• Updates or fixes from Alpine Linux and OpenSSH.
• Whether other Linux distributions with the same setup are found to be affected.
• Checks of systems for passwordless accounts and weak hash settings.