Ethical Hacking News
Decade-old vulnerability *sshole exposed in Alpine Linux, potentially affecting millions of systems.
A decade-old vulnerability in Alpine Linux, dubbed *sshole*, has been discovered, allowing hackers to SSH into Linux devices with no password.The vulnerability exists in the interaction between OpenSSH and musl, and can be exploited by inputting more than 256 characters in the password field when logging into a passwordless account.The vulnerability affects certain configurations of Alpine Linux and other distributions, including embedded devices and other types of devices that may not be easily updated.Only a fraction of the 22 million systems listed on Shodan are estimated to meet the conditions necessary for exploitation.The origin of the vulnerability is attributed to an erroneous use of the code library, and updates are available to address the issue.Users of Alpine Linux and other distributions using musl and OpenSSH are advised to investigate and install patches to prevent exploitation.
A recent discovery has shed light on a decade-old vulnerability in Alpine Linux, a lightweight and widely used distribution, that could potentially allow hackers to SSH into Linux devices with no password. The vulnerability, dubbed *sshole, has sparked concerns among security experts and users of Alpine Linux, as it may affect a large number of systems, including those used in embedded devices, routers, and other types of devices that may not be easily updated.
The vulnerability exists in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library used in Alpine Linux. According to the vulnerability description, certain configurations of Alpine Linux are affected, and other distributions may be as well. The vulnerability can be exploited if a system has at least one user account that is accessible using a password hashed using the SHA256 or SHA512 functions, and the target system account is configured to be passwordless.
The consequences of exploiting this vulnerability are high, as an attacker can gain access to the system by inputting more than 256 characters in the password field when logging into a passwordless account. Security firm Checkpoint reported that the use of SHA256 or SHA512 functions "matters because sshd borrows that account's salt. Without it, the attack fails." Furthermore, the vulnerability does not affect root accounts under the default PermitRootLogin prohibit password setting, but reachable accounts with doas or sudo rights can still become root.
The discovery of *sshole has led to concerns about the potential impact on large numbers of systems, particularly those used in embedded devices and other types of devices that may not be easily updated. According to security firm Detectify, Shodan lists around 22 million systems with SSH open on port 22, and it is estimated that only a fraction meet the conditions necessary for exploitation.
The origin of the vulnerability is not entirely clear, with OpenSSH and musl developers attributing it to an erroneous use of the code library. Musl developer Rich Felker stated that musl developers have wanted to make changes to the mechanism "for a while now" and planned to do so in an upcoming release. Alpine has also issued an update to address the vulnerability.
In light of this discovery, users of Alpine Linux and other distributions that use both musl and OpenSSH are advised to take immediate action to investigate if they are affected. Installing both Alpine and OpenSSH patches can help prevent exploitation of this vulnerability. As with any security issue, it is essential to stay informed and take proactive measures to protect systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Decade-Old-Vulnerability-Exposed-The-sshole-Weakness-in-Alpine-Linux-ehn.shtml
https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/
Published: Thu Nov 5 20:07:43 2026 by llama3.2 3B Q4_K_M
