Digital Event Horizon
*sshole, a decade-old vulnerability that lets hackers SSH into Linux devices, has the potential to affect millions of systems. The vulnerability, which can be exploited by inputting more than 256 characters in the password field, has significant consequences, allowing attackers to log in without knowing any password. Users of Linux systems that use both musl and OpenSSH are advised to take immediate action to investigate and patch their systems to mitigate the risks associated with this vulnerability.
A vulnerability dubbed *sshole has been discovered in Alpine Linux, threatening millions of Linux devices worldwide. The vulnerability allows hackers to SSH into Linux devices with no password, exploiting the interaction between OpenSSH and musl. Conditions to exploit the vulnerability include having a password hashed using SHA256 or SHA512 functions and a passwordless system account. The vulnerability has significant consequences, allowing attackers to log in without knowing any password. Experts recommend users of affected systems take immediate action to investigate and install patches to mitigate the risks.
A recent discovery of a vulnerability, dubbed *sshole, has sent shockwaves through the cybersecurity community, threatening millions of Linux devices worldwide. The vulnerability, which allows hackers to SSH into Linux devices with no password, has been identified in certain configurations of Alpine Linux, a widely used and lightweight Linux distribution.
According to the context data, the vulnerability exists in the interaction between OpenSSH, a code library implementing SSH connections, and musl, a lightweight alternative to the libc library used in Alpine. This interaction is particularly susceptible to exploitation when OpenSSH is configured to use musl and does not utilize PAM (pluggable authentication modules), a framework that handles user authentication and account-access checks.
To exploit this vulnerability, an attacker must meet several conditions, including having at least one user account accessible using a password hashed using SHA256 or SHA512 functions. Additionally, the target system account must be configured to be passwordless, by specifying a “*” in the password field in /etc/shadow, the Linux file where password hashes are stored. This setting is common for certain types of accounts, particularly those that use certificate-based authentication.
Once all the conditions are met, an attacker can gain access to the system by inputting more than 256 characters in the password field, a process that requires no retries or reconnections. This vulnerability has significant consequences, allowing attackers to log in without knowing any password, effectively bypassing the security measures in place.
The impact of *sshole extends beyond Alpine Linux, as it may also affect other distributions that use similar configurations. Security firm Checkpoint reported that the use of SHA256 or SHA512 functions "matters because sshd borrows that account's salt. Without it, the attack fails." Furthermore, researchers from Checkpoint noted that root accounts are safe under the default PermitRootLogin prohibit password setting, though reachable accounts with doas or sudo rights can still become root.
Despite the uncertainty surrounding the extent of the vulnerability, experts caution that the potential impact is substantial. The Docker Hub base image for Alpine has more than 1 billion downloads, and Alpine has been widely adopted in various types of devices, including routers, smart TVs, industrial controllers, and desktops and servers. Given the ease and speed of testing, locating vulnerable devices is likely to require minimal effort.
As a result, security experts recommend that users of Linux systems that use both musl and OpenSSH take immediate action to investigate if they are affected. Installing patches for Alpine and OpenSSH on all affected systems is crucial to mitigate the risks associated with *sshole.
In conclusion, *sshole represents a significant threat to the security of millions of Linux devices worldwide. As the vulnerability continues to be explored, it is essential to stay vigilant and take proactive measures to protect against this potential security risk.
Related Information:
https://www.digitaleventhorizon.com/articles/sshole-A-Decade-Old-Vulnerability-Threatens-Millions-of-Linux-Devices-deh.shtml
https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/
Published: Thu Nov 5 19:06:38 2026 by llama3.2 3B Q4_K_M
