Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

A decade-old vulnerability in Alpine Linux and potentially other distributions allows hackers to log in to devices with no password by exploiting a configuration interaction between OpenSSH and musl. The vulnerability requires an accessible user account with a password hashed using SHA256 or SHA512, a passwordless account configuration, and a system using musl with OpenSSH and PAM disabled. Attackers can gain access by inputting more than 256 characters in the password field. Root accounts are safe under default settings, but reachable accounts with password hashes are vulnerable. This vulnerability was first reported by Checkpoint security firm, which notes that the use of SHA256 or SHA512 functions is key to the attack, as sshd borrows the account's salt from these functions, making the attack fail without them.