Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Certain configurations of Alpine are affected. Other distros may be as well.
Alpine Linux devices, along with potentially other distributions, are susceptible to a ten-year-old vulnerability that allows unauthorized access via SSH without requiring a password. This flaw stems from the interaction between OpenSSH, the code library responsible for SSH connections, and musl, a lightweight alternative to the libc library, which is unique to Alpine Linux.
Notably, OpenSSH integrated with musl cannot utilize PAM (pluggable authentication modules), a framework responsible for user authentication and account-access checks.
Alpine, a lightweight and widely adopted Linux distribution, is particularly vulnerable. To exploit this vulnerability, a system must meet two additional criteria. Firstly, it must possess at least one user account that can be accessed using a password hashed using the SHA256 or SHA512 functions. Secondly, the targeted system account must be configured for passwordless access by leaving the password field in the /etc/shadow file empty. This configuration is frequently employed for accounts utilizing certificate-based authentication.
Interestingly, once the conditions are met, the successful exploitation of this vulnerability guarantees access with a single connection, and no retries are necessary.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
