The vulnerability, dubbed *sshole, stems from an interaction between OpenSSH and the musl library, specifically when PAM is not utilized. Successful exploitation requires a system to have an active user account with a password hash generated by SHA256 or SHA512, and the account must be configured as passwordless with an asterisk in the /etc/shadow file.
Attackers can bypass authentication by entering more than 256 characters into the password field during an SSH connection. While root accounts are typically protected by default settings, accounts with sudo or doas privileges remain at risk. Researchers from Checkpoint confirmed the necessity of the account's salt for the exploit to function.
Alpine Linux is particularly exposed due to its widespread use in embedded devices, routers, and container images, with its Docker Hub base image exceeding 1 billion downloads. Shodan data indicates approximately 22 million systems currently have port 22 open, and while only a portion may be vulnerable, the exploit is noted for its speed and ease of execution.
Responsibility for the flaw remains disputed, with OpenSSH attributing the cause to external factors and musl developers characterizing it as an erroneous implementation by the caller. Both OpenSSH and Alpine have released updates to address the issue. Other platforms like OpenWRT, buildroot, and yocto are also under investigation for potential susceptibility.
