Sshhole Linux Vulnerability Allows Hackers to Bypass SSH Passwords

Devices running specific configurations of Alpine Linux and potentially other distributions are affected by a decade-old vulnerability dubbed Sshhole, which allows attackers to log into systems without providing any password.

• The vulnerability occurs in the interaction between OpenSSH and musl when PAM authentication is not used.
• Attackers can bypass authentication by inputting more than 256 characters into the password field.
• Affected systems include millions of Docker containers, routers, and IoT devices running Alpine.
• Both Alpine and OpenSSH maintainers have released security updates to patch the flaw.

Technical Details and Prerequisites

The vulnerability exists in how OpenSSH interacts with musl, a lightweight alternative to libc used in Alpine Linux. For the vulnerability to be exploited, the system must not use PAM (pluggable authentication modules), and it must contain at least one user account hashed with SHA256 or SHA512.

Furthermore, the target account must be configured as passwordless by specifying an asterisk in the shadow file. Checkpoint researchers noted that sshd borrows the account's salt to complete the process, and the target account must be actively configured and accessible.

Scope of the Vulnerability

Despite the specific prerequisites, Sshhole poses a widespread threat. Alpine's base image on Docker Hub has crossed one billion downloads, and the distribution is extensively used in routers, smart TVs, and embedded industrial controllers.

Detectify notes that Shodan indexes roughly 22 million systems with open SSH ports globally. Given how quickly each potential device can be tested, attackers can identify vulnerable instances with minimal effort.

Developer Response and Mitigation

Discussions persist regarding the root cause, with OpenSSH stating the issue lies outside sshd and musl developers calling it caller misuse. Nevertheless, official patches have been released by Alpine and OpenSSH.

Administrators running Linux environments with musl and OpenSSH should audit their infrastructure immediately and apply the latest available patches to prevent unauthorized remote access.