Vulnerability enabling passwordless SSH login found in Alpine Linux configurations — Ars Technica

A decade-old vulnerability dubbed sshole has been found in some Alpine Linux configurations, potentially allowing remote SSH login without knowing a password. As Ars Technica reports, the issue arises from the interaction between OpenSSH and the musl library, which Alpine uses instead of the more common libc.

To exploit OpenSSH running with musl, it must also be configured without PAM, a mechanism of modules for authentication and account-access checks. Other Linux distributions may also potentially be vulnerable if they use the same configurations.

Conditions for the attack

The vulnerability, which its discoverer named sshole, does not affect all devices running Alpine Linux. For an attack, the system must have at least one active account with a password hashed using SHA256 or SHA512. At the same time, the target account must be configured without a password: the password field in the /etc/shadow file must contain an empty value.

Under these conditions, an attacker who can connect to the device's SSH port can log into the passwordless account by entering more than 256 characters in the password field. Alpine developers said that a single connection is sufficient and no repeated attempts are required.

More current news is available on the UA.News Telegram channel Telegram.

Updates for Alpine and OpenSSH

Checkpoint said that SHA256 or SHA512 hashes are required for the attack because the sshd process uses the salt of the corresponding account. The company's researchers also reported that this account must be active. Root accounts are protected by the default PermitRootLogin prohibit-password setting, but an accessible user with sudo or doas privileges could potentially obtain root privileges.

Alpine is widely used in container images, routers, smart TVs, and industrial controllers. The Alpine base image on Docker Hub has more than 1 billion downloads. According to Detectify, Shodan lists about 22 million systems with SSH port 22 open, although only some of them meet the conditions for exploitation.

OpenSSH has already released an update, and Alpine has also issued a fix. musl developer Rich Felker believes that the issue lies not in the library itself but in the application's incorrect use of the mechanism; changes to musl are planned for the next release. There is currently no known CVE identifier for this vulnerability.