Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into devices with no password. The vulnerability exists in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library that, unlike most other Linux distributions, is used in Alpine. Further, OpenSSH using musl (pronounced muscle) must not use PAM (pluggable authentication modules), a framework that handles user authentication and account-access checks. Alpine is a lightweight, widely used Linux distribution. Other platforms may be affected if they use the same configurations.

运行某些 Alpine Linux 配置以及可能其他发行版的设备，正受到一个存在了十年的漏洞影响，该漏洞允许攻击者在无需密码的情况下登录设备。此漏洞存在于实现 SSH 连接的代码库 OpenSSH 与 musl 之间的交互中；musl 是 libc 库的一种轻量级替代品，与大多数其他 Linux 发行版不同，Alpine 使用了 musl。此外，使用 musl 的 OpenSSH 必须不使用 PAM（可插拔认证模块），即处理用户认证和账户访问检查的框架。Alpine 是一种轻量级且广泛使用的 Linux 发行版。如果其他平台使用相同的配置，也可能受到影响。

There are two other conditions necessary for successful exploitation. First, a system must have at least one user account that’s accessible using a password that is hashed using the SHA256 or SHA512 functions. Second, the target system account must be configured to be passwordless, by way of specifying a “*” in the password field in /etc/shadow, the Linux file where password hashes are stored. Passwordless accounts are commonly used for accounts that use certificate-based authentication. This setting is common for certain types of accounts.

成功利用该漏洞还需要另外两个条件。首先，系统必须至少有一个用户账户，该账户可以使用通过 SHA256 或 SHA512 函数哈希处理的密码进行访问。其次，目标系统账户必须配置为无密码状态，即在存储密码哈希的 Linux 文件 /etc/shadow 的密码字段中指定“*”。无密码账户通常用于使用基于证书认证的账户。这种设置在某些类型的账户中很常见。

When all the conditions are met, the consequences are high. “An attacker who can reach your SSH port can log in without knowing any password,” Alpine maintainers said Thursday. “It takes one connection, works every time, and needs no retries.” When logging into a passwordless account, the attacker can gain access by inputting more than 256 characters in the password field. Security firm Checkpoint said that the use of the SHA256 or SHA512 functions “matters because sshd borrows that account’s salt. Without it, the attack fails.”

当所有条件满足时，后果非常严重。Alpine 维护者周四表示：“能够访问你 SSH 端口的攻击者可以在不知道任何密码的情况下登录。只需一次连接，每次都能成功，且无需重试。”在登录无密码账户时，攻击者只需在密码字段中输入超过 256 个字符即可获得访问权限。安全公司 Checkpoint 表示，使用 SHA256 或 SHA512 函数“至关重要，因为 sshd 会借用该账户的盐值（salt）。如果没有它，攻击就会失败。”

Company researchers said their testing also showed that the account must be active, not just hold a hash. Checkpoint further reported that root accounts are safe under the default PermitRootLogin prohibit password setting, though reachable accounts with doas or sudo rights can still become root. Despite the prerequisites, *sshole—the vulnerability name given by the person who discovered it—likely threatens large numbers of systems. The Docker Hub base image for Alpine has more than 1 billion downloads. Alpine has long been popular in routers, smart TVs, industrial controllers, and other types of embedded devices, many of which can’t be easily updated, if at all.

该公司研究人员表示，他们的测试还表明账户必须处于活动状态，而不仅仅是拥有一个哈希值。Checkpoint 进一步报告称，在默认的 PermitRootLogin prohibit password 设置下，root 账户是安全的，尽管拥有 doas 或 sudo 权限的可访问账户仍然可以成为 root 用户。尽管有这些先决条件，*sshole（发现者为该漏洞起的名字）仍可能威胁到大量系统。Alpine 的 Docker Hub 基础镜像下载量已超过 10 亿次。Alpine 长期以来在路由器、智能电视、工业控制器和其他类型的嵌入式设备中很受欢迎，其中许多设备很难甚至无法轻松更新。

More recently, Alpine has been adopted for use in desktops and servers. Alpine is also used in many container images. According to security firm Detectify, Shodan lists around 22 million systems with SSH open on port 22. Only a fraction meet the conditions necessary for exploitation, but given the ease and speed of testing each one, locating vulnerable devices won’t require much effort or time. It’s not entirely clear where the vulnerability resides. OpenSSH, which issued an update Thursday, said: “We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there.”

最近，Alpine 已被用于桌面和服务器。Alpine 也被用于许多容器镜像中。据安全公司 Detectify 称，Shodan 列出了约 2200 万个在 22 端口开放 SSH 的系统。只有一小部分满足利用该漏洞的必要条件，但考虑到测试每个系统的简便性和速度，定位易受攻击的设备并不需要太多精力和时间。目前尚不完全清楚漏洞存在于何处。周四发布更新的 OpenSSH 表示：“我们认为该漏洞的根本原因不在 sshd 内部，但可以通过 sshd 进行利用，并可以在那里进行规避。”

Musl developer Rich Felker, meanwhile, wrote: “It is my position that this is not a bug in musl just an erroneous use by the caller.” Felker went on to say that musl developers have wanted to make changes to the mechanism “for a while now” and planned to do so in an upcoming release. Alpine has also issued an update. It’s not yet known what other packages may be vulnerable. The person who discovered *sshole said OpenWRT is affected, but by default, that OS uses the Dropbear package, not OpenSSH, for SSH connections (though maintainers provide instructions for installing the latter).

与此同时，musl 开发人员 Rich Felker 写道：“我的立场是，这不是 musl 中的错误，只是调用者的错误使用。”Felker 接着说，musl 开发人员“已经有一段时间”想要对该机制进行更改，并计划在即将发布的版本中这样做。Alpine 也发布了更新。目前尚不清楚还有哪些其他软件包可能受到影响。发现 *sshole 的人表示 OpenWRT 受到影响，但默认情况下，该操作系统使用 Dropbear 软件包而非 OpenSSH 进行 SSH 连接（尽管维护者提供了安装后者的说明）。

The discoverer also names the packages buildroot and yocto as being affected, but that isn’t yet confirmed. Despite the uncertainty, anyone using a Linux system that uses both musl and OpenSSH should take time to immediately investigate if they’re affected. A good starting point is here. Both Alpine and OpenSSH patches should be installed on all affected systems. There is no known CVE designation for the vulnerability.

发现者还指出 buildroot 和 yocto 软件包也受到影响，但这尚未得到证实。尽管存在不确定性，任何使用同时包含 musl 和 OpenSSH 的 Linux 系统的人都应花时间立即调查自己是否受到影响。一个好的起点在这里。所有受影响的系统都应安装 Alpine 和 OpenSSH 的补丁。目前该漏洞尚无已知的 CVE 编号。