Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
A newly revealed interaction between OpenSSH and the musl C library allows attackers to log into password-disabled accounts on certain Linux distributions simply by typing an oversized password. Discovered by security researcher Ozgun Kultekin, the vulnerability affects distributions using musl, notably Alpine Linux, OpenWrt, Buildroot, and Yocto. OpenSSH has issued a fix in version 10.6p2, and administrators can mitigate the issue by setting PasswordAuthentication to no in their configuration. [1][2]
The bug arises when an account has an asterisk in the shadow file to block password authentication. Due to a 2016 modification to prevent username enumeration, OpenSSH still hashes passwords for disabled accounts. When an entered password exceeds the 256-byte limit of the musl crypt() function, musl returns an asterisk as an error. OpenSSH then compares those matching asterisks, mistakenly verifying the login. Exploitation requires OpenSSH without PAM authentication, password logins enabled, an account with an asterisk hash, and another account with a valid password hash. [1][2]
The issue poses the steepest risk for Alpine Linux, a widespread base image across Docker containers, cloud systems, and embedded hardware where PAM is disabled by default. Kultekin warned that official Alpine Linux images on AWS and Azure include an affected default account with passwordless doas privileges, which could grant root access. Systems using glibc, such as Ubuntu, Debian, and Fedora, remain unaffected. [1][2]
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password.
via BleepingComputer
The internet is still reeling from the PHP engine vulnerability and all other security vulnerabilities found over the past few weeks, and we're not done. Today's special is quite spicy: you can get into Alpine, OpenWRT, and other Linux distros without needing a password, thanks to a combined bug with OpenSSH and musl libc. Just randomly type over 256 characters on the password prompt and you'll be let in through the SSHhole.
via Tom’s Hardware