Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

A vulnerability dubbed *sshole can let an attacker log into some Linux devices over SSH without knowing a password. It matters because Alpine Linux is widely used in embedded devices, servers and containers, and some affected devices may be difficult to update.

Exploitation requires OpenSSH with musl and no PAM, an active account with a SHA256- or SHA512-hashed password, and a target account configured as passwordless. An attacker can then enter a password longer than 256 characters; the maintainers say one connection is enough. Alpine and OpenSSH have issued updates, but the scope beyond Alpine remains uncertain; Shodan lists about 22 million systems with SSH open, only a fraction of which are expected to meet the conditions.