A newly disclosed vulnerability in the interaction between OpenSSH and the musl C library allows attackers to log into certain Linux systems without knowing any password. The flaw, which the person who discovered it named *sshole, affects configurations using OpenSSH with musl instead of the more common libc library, as found in the Alpine Linux distribution. Alpine maintainers said an attacker who can reach the SSH port can log in with one connection, that the attack works every time and needs no retries. Other platforms may be affected if they use the same configurations.
Exploitation requires specific conditions. OpenSSH running with musl must not use PAM, the pluggable authentication modules framework that handles user authentication and account-access checks. The system must also have at least one account accessible by a password hashed with the SHA256 or SHA512 functions, and that account must be configured as passwordless through a "*" in the password field of /etc/shadow, the file where Linux stores password hashes. Passwordless accounts are commonly used for certificate-based authentication. According to Checkpoint, the attack depends on sshd borrowing the account's salt from those hash functions, and the account must be active, not merely hold a hash. Checkpoint also reported that root accounts are safe under the default PermitRootLogin prohibit password setting, though reachable accounts with doas or sudo rights can still become root. An attacker gains access by entering more than 256 characters in the password field.
The exposure could be broad. The Docker Hub base image for Alpine has more than 1 billion downloads, and Alpine has long been popular in routers, smart TVs, industrial controllers and other embedded devices, many of which cannot be easily updated. Alpine has more recently been adopted for desktops and servers and is used in many container images. Detectify said Shodan lists around 22 million systems with SSH open on port 22, and while only a fraction meet the exploitation conditions, testing each one is easy and fast.
Responsibility for the flaw is disputed. OpenSSH, which issued an update, said it considers the root cause to be outside sshd but exploitable through sshd and avoidable there. Musl developer Rich Felker wrote that in his position this is not a bug in musl but an erroneous use by the caller, and said musl developers have wanted to change the mechanism for a while and planned to do so in an upcoming release. Alpine has also issued an update.
It is not yet known what other packages may be vulnerable. The discoverer said OpenWRT is affected, though by default that OS uses the Dropbear package rather than OpenSSH for SSH connections, and named buildroot and yocto as affected without confirmation. No CVE designation is known for the vulnerability.
More cybersecurity news from TechManNews.
