A newly disclosed OpenSSH vulnerability nicknamed *sshole allows attackers to log into certain Alpine Linux and other musl-based Linux accounts that are supposed to block password authentication, simply by submitting an oversized password of 256 characters or more. Security researcher Ozgun Kultekin, who found the flaw and published details on Thursday, says it has existed since 2016.
The bug only affects OpenSSH servers running on Linux distributions that use the musl C library instead of glibc, including Alpine Linux, OpenWrt, Buildroot and Yocto, and only under specific authentication configurations. Debian, Ubuntu and Fedora are not vulnerable. OpenSSH has shipped a fix in version 10.6p2, and Alpine has also issued an update.
How the *sshole OpenSSH flaw works
Linux accounts can be blocked from password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file. Because * is not a valid hash, no password should ever unlock those accounts. The problem traces back to a 2016 OpenSSH patch for CVE-2016-6210, which made the server hash passwords even for accounts with no usable hash, so attackers could not identify valid usernames from response times.
On musl systems, the crypt() function also returns * when hashing fails, including when the submitted password exceeds its 256-byte limit. An attacker can therefore send an oversized password and have OpenSSH compare the returned * against the stored * — a match that results in a successful login. Kultekin says exploitation requires all of these conditions:
The flaw does not bypass real passwords on accounts that have valid hashes. Check Point researchers told Ars Technica that the SHA256 or SHA512 hash matters because sshd borrows that account's salt, and that the account must be active, not merely hold a hash. Root accounts are safe under the default PermitRootLogin prohibit-password setting, but reachable accounts with doas or sudo rights can still reach root.
