OpenSSH sshhole vulnerability on musl Linux affects security

A critical security flaw has been disclosed in OpenSSH running on musl-based Linux systems, designated under the name sshhole. The vulnerability affects popular lightweight environments including Alpine, OpenWrt, Buildroot, Yocto, and numerous Docker containers.

• The vulnerability has existed since 2016, affecting passwordless accounts.
• Long strings between 257 and 1024 characters are mistakenly accepted as valid passwords.
• Systems utilizing glibc or PAM implementations are completely safe.
• Cloud environments using default Alpine images face significant risks.

Understanding the sshhole Vulnerability

Accounts that are not intended to require passwords — such as root, deployment users relying strictly on SSH keys, LDAP users, or default accounts in Alpine images for AWS and Azure — would start accepting any password if its length exceeded 256 characters. Specifically, the system accepts any string between 257 and 1024 characters as a legitimate password.

For the exploit to succeed, several conditions must align. Does your sshd run in a musl Linux environment? Is PAM disabled, as openssh-server defaults to without PAM on Alpine? Is there an account with an asterisk (*) password alongside another account with a valid password?

Impact on Cloud and Container Environments

The vulnerability poses a severe risk in official cloud images. For instance, official Alpine Linux images for AWS and Azure feature this exact configuration for the default alpine user, who also holds the capability to execute commands via doas without a password, effectively granting root privileges.

Users of mainstream distributions such as Debian, Ubuntu, Fedora, or any other glibc-based OS are safe. Systems leveraging PAM or utilizing alternative implementations like dropbear or native OpenBSD OpenSSH remain unaffected by this flaw.

What This Means for IT Professionals

The discovery of the sshhole vulnerability highlights the critical need for continuous security audits in containerized and minimalist Linux environments. System administrators managing musl-based infrastructure should verify their SSH configurations and apply necessary security patches immediately.