sshole flaw lets attackers reach root on some musl-based Linux systems via long passwords
- Severity
- High
- Sources
- 1
What happened
The sshole issue affects OpenSSH sshd on musl libc Linux systems, including Alpine Linux, when PAM is not used and password authentication is enabled. It needs at least one account with an asterisk in its password field and another account with a valid password hash. Supplying a password of 257 to 1,024 bytes can grant access to asterisk-locked accounts, including root, and the root path depends on OpenSSH's configuration. The flaw traces to a 2016 interaction between musl's crypt() asterisk return and OpenSSH's dummy hashing workaround. Fixed in OpenSSH 10.6p2 and later. Alternatively, disable password authentication and restart sshd. No exploitation has been reported. Review the researcher's writeup for a CLI check of recent password changes on no-password accounts.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update OpenSSH to version 10.6p2 or newer on any affected musl-based system.
- If you cannot update, disable password authentication and restart the SSH daemon.
- Check whether any no-password accounts on sensitive machines have recently had a password set, using the command in the researcher's writeup.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products