Industry·
Alpine Linux *sshole Vulnerability Allows Passwordless SSH Access
A decade‑old flaw in the OpenSSH‑musl interaction lets attackers log into Alpine‑based systems without a password when specific conditions are met.
A newly disclosed flaw, dubbed *sshole, lets attackers log into certain Alpine Linux systems via SSH without supplying a password.
The bug arises from the way OpenSSH interacts with the musl C library when PAM is disabled. Exploitation requires three factors: the target runs Alpine (or another musl‑based distro) with OpenSSH built without PAM, at least one user account stores a SHA‑256 or SHA‑512 password hash, and that account is marked passwordless (a “*” in /etc/shadow).
Why it matters for GPU / AI infrastructure
Alpine images dominate container registries and are widely used on edge devices, routers, and GPU‑accelerated inference servers. A single successful SSH login can give an attacker a foothold to tamper with model weights, steal datasets, or hijack compute resources.
Operators should enable PAM, enforce key‑only authentication, and patch OpenSSH to the latest release. Regular scanning of exposed SSH ports is also advised.
- aigpu
- ai gpu
- ai gpu cloud
- aigpu dubai
- security
- linux
- ssh
- vulnerability
By AiGpu Editorial · Editorial rewrite based on public reporting (Ars Technica)
← All articles