Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

Alpine Linux devices, along with potentially other distributions, are susceptible to a ten-year-old vulnerability that allows unauthorized access via SSH without requiring a password. This flaw stems from the interaction between OpenSSH, the code library responsible for SSH connections, and musl, a lightweight alternative to the libc library, which is unique to Alpine Linux.

Notably, OpenSSH integrated with musl cannot utilize PAM (pluggable authentication modules), a framework responsible for user authentication and account-access checks.

Alpine, a lightweight and widely adopted Linux distribution, is particularly vulnerable. To exploit this vulnerability, a system must meet two additional criteria. Firstly, it must possess at least one user account that can be accessed using a password hashed using the SHA256 or SHA512 functions. Secondly, the targeted system account must be configured for passwordless access by leaving the password field in the /etc/shadow file empty. This configuration is frequently employed for accounts utilizing certificate-based authentication.

Interestingly, once the conditions are met, the successful exploitation of this vulnerability guarantees access with a single connection, and no retries are necessary.