A Decade-Old Vulnerability Lets Hackers Log Into Linux Devices Without a Password

A newly highlighted vulnerability named *sshole affects devices running specific configurations of Alpine Linux and potentially other distributions. The flaw stems from the interaction between OpenSSH and musl, occurring under specific conditions such as the absence of PAM and the presence of passwordless accounts utilizing SHA256 or SHA512 hashing functions. When these prerequisites are met, an attacker can input more than 256 characters into the password field to log into a device without knowing any password. Because Alpine Linux is widely used in containers, smart TVs, routers, and industrial controllers, security firms note that the vulnerability poses a substantial threat across numerous systems.