SSH flaw lets attackers bypass passwords on some Linux systems

A vulnerability named *sshole affects certain configurations of Alpine Linux and possibly other distros that use musl with OpenSSH. The flaw arises from how OpenSSH interacts with musl and the PAM authentication framework; Alpine’s combination of musl and OpenSSH that does not use PAM is the focus.

Exploitation is possible when a system has at least one password-protected account whose password is hashed with SHA-256 or SHA-512, and at least one account is configured as passwordless (a “*” in the /etc/shadow password field). If these conditions are met and an attacker can reach the SSH port, they can log in without knowing a password, simply by submitting a password longer than 256 characters. OpenSSH notes the root cause lies outside sshd, though it is exploitable via sshd.

Security firm Checkpoint’s testing emphasises that the hash function and the account’s salt are involved, and that the target account must be active, not merely contain a hash. Root access is avoided for accounts with PermitRootLogin set to prohibit-password, but accounts with doas or sudo rights can still escalate.

The broader threat is considerable: Docker’s Alpine base image has over a billion downloads, and Shodan lists around 22 million systems with SSH open on port 22, though only a subset meet the exploitation prerequisites. The discoverer mentions OpenWRT and packages buildroot and yocto as possibly affected, but confirmation is pending. OpenSSH issued an update (10.6p2); Rich Felker of musl suggested the issue stems from caller use rather than musl itself. Alpine and OpenSSH patches are advised for affected systems. No CVE designation has been assigned.