sshole vulnerability: SSH into Alpine Linux with no password

Type 257 characters into the password prompt and you’re in. No brute force, no retries, no zero-day trickery with heap sprays. That’s the whole exploit behind the sshole vulnerability (the discoverer spelled it *sshole, and I’ll let you fill in the asterisk), a bug that has apparently been sitting in some Alpine Linux setups for about a decade.

I read the write-up twice because I didn’t believe the first pass. It’s that dumb. And that’s exactly why it’s scary.

How the sshole vulnerability works

The problem isn’t in one piece of software, it’s in the handshake between three of them. You need OpenSSH built against musl, the lightweight libc that Alpine uses instead of glibc, and you need sshd running without PAM. That’s the default shape of an Alpine box, by the way, not some exotic config.

Then two more things have to line up on the target. The machine must have at least one active account whose password is hashed with SHA-256 or SHA-512 (so, basically any normal account). And there has to be an account marked passwordless, with a lone * in the password field of /etc/shadow. That’s the standard way you set up accounts that only log in with keys or certificates. Service accounts, automation users, that kind of thing.

Put it all together and sshd borrows the salt from the first account, feeds an oversized password into musl’s crypt routine, and the comparison comes back as a match for the starred account. The Alpine maintainers put it bluntly in the advisory Ars Technica quoted: “An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”

Root is mostly safe thanks to the default PermitRootLogin prohibit-password. Mostly. If the account you just walked into has doas or sudo rights, congratulations, you’re root anyway.

Why Alpine Linux makes this a big deal

Alpine isn’t some hobby distro. Its Docker Hub base image has passed a billion downloads. It runs inside routers, smart TVs, industrial controllers and a thousand embedded gadgets whose firmware hasn’t seen an update since the Obama administration. According to Detectify, Shodan lists roughly 22 million machines with port 22 open to the internet. Only a slice of those tick every box, but testing a candidate takes one connection and a second of your time, so finding the vulnerable ones is a weekend script, not a research project.

Now for the part that made me sigh. Nobody wants to own the bug. OpenSSH shipped a fix on Thursday while stating that the root cause is “outside sshd, but it is exploitable via sshd and can be avoided there.” Rich Felker, who maintains musl, answered that “this is not a bug in musl just an erroneous use by the caller,” while admitting his team had wanted to change that mechanism “for a while now.” Alpine, stuck in the middle, pushed its own update. Classic open source hot potato: everyone’s technically right, and the user is still exposed.

There’s no CVE yet either, which means your vulnerability scanner is probably whistling happily and reporting green. The discoverer says OpenWrt, Buildroot and Yocto are affected too, though OpenWrt ships Dropbear by default rather than OpenSSH, and the other two haven’t been confirmed. If you build your own images (and I know some of you do, I’ve seen your AlpineBSD experiments), assume you’re on the list until proven otherwise.

What I’d do right now

First, inventory. Anything with musl plus OpenSSH plus no PAM is a suspect: Alpine containers that expose sshd, tiny VPS images, that NAS you flashed three years ago. Then patch both Alpine and OpenSSH, not one or the other. If a box can’t be updated, put its SSH port behind a VPN or a firewall rule tonight, and audit /etc/shadow for starred accounts that have sudo or doas privileges. Removing the * entries you don’t actually need is a five-minute job that closes the door completely.

And for those of you running Alpine images in production without ever opening sshd, this is your reward for keeping things minimal. Enjoy it, it doesn’t happen often.

Ten years of security, undone by a password that was simply too long.