A decade-old vulnerability in OpenSSH allows attackers to gain unauthorized access to certain Linux environments without knowing the password. Although the vulnerability primarily affects Alpine Linux, other distributions may also be vulnerable. Security updates have since been released.
The vulnerability has been dubbed *sshole. The flaw stems from an unexpected interaction between OpenSSH and musl, a lightweight C library used by Alpine Linux. Ars Technica reports that attackers can exploit the vulnerability by entering an unusually long password when attempting to log in via SSH.
The attack succeeds if OpenSSH is running without Pluggable Authentication Modules (PAM). This is a framework used to manage or handle authentication. Password authentication must be enabled, and the system must have both an account configured to reject password logins and another active account with a valid SHA-256 or SHA-512 password hash.
Under these conditions, an attacker can gain access to the protected account by entering a password longer than 256 characters. The issue occurs because musl returns an asterisk (*) when password hashing fails. OpenSSH may incorrectly interpret this result as a match with the asterisk stored in the account’s password field.
Alpine Linux administrators warn that the vulnerability can be exploited with a single connection, without requiring multiple login attempts.
Concerns about embedded systems
The vulnerability is a cause for concern because Alpine Linux is widely used in containers, routers, industrial controllers, and other embedded systems. Many of these devices are not easy to update, meaning they may remain vulnerable for an extended period.
Security researchers at Check Point confirm that an attacker can gain privileges if the vulnerable account has sudo or doas permissions. Alpine Linux cloud images used on AWS and Azure have configurations that may allow attackers to gain root access.
However, the vulnerability does not affect every Linux installation. Systems using glibc, including stock Debian, Ubuntu, and Fedora, are not vulnerable in this case. OpenSSH installations that use PAM are also not vulnerable.
Emergency updates released
OpenSSH addresses the vulnerability in version 10.6p2, which was released on November 5. Alpine Linux also provided updates for affected versions.
Administrators are advised to install the patches immediately and restart the SSH service. If an immediate update is not possible, disabling SSH password authentication is a temporary workaround.
Security teams should also check the authentication logs for successful password logins to accounts that should have been denied access.
The exact number of vulnerable systems is unknown. Other Linux distributions that use musl and OpenSSH may also be affected, although vulnerability depends on specific authentication settings.
Lees ook: Malicious Claude Code extension in Cursor installs SSH backdoor