A flaw in OpenSSH on musl-based Linux, nicknamed “*sshole,” lets an attacker log in to accounts that are supposed to block passwords just by sending a password over 256 bytes, BleepingComputer and The Register report. It’s fixed in OpenSSH 10.6p2.
How it works
Accounts with * in /etc/shadow can’t use passwords. Since 2016, sshd hashes a dummy password even for those accounts to stop username enumeration. musl’s crypt() returns * when hashing fails, including for passwords over 256 bytes. So * matches *, and you’re in.
You’re exposed only if all of these are true
- musl libc: Alpine, OpenWrt, Buildroot, Yocto
- PAM is off (the default in Alpine’s openssh-server) and password auth is on
- One account has
*and another has a real password hash
Alpine’s official AWS and Azure images have an affected default alpine account with passwordless doas, so that means root. glibc distros (Debian, Ubuntu, Fedora) and PAM setups are safe. The researcher found it with AI agents running about 17,600 auth tests.
Fix
Run apk upgrade openssh, or set PasswordAuthentication no and restart sshd. Then check your logs for password logins to accounts that shouldn’t have any.
God Bless, and Happy hacking!
