A flaw nicknamed *sshole, disclosed on 5 November, lets an attacker who can reach the SSH port log in to accounts that were never meant to accept a password on Alpine Linux and other systems built on the musl C library. OpenSSH released version 10.6p2 the same day, and Alpine has shipped fixed packages for every release back to 3.16.
The bug has existed since 2016 and only bites under specific settings, but those settings are the defaults in some common setups, including Alpine's official AWS and Azure cloud images in certain conditions. Anyone running sshd on a musl-based system should check it now.
Why an empty password field stopped meaning no
Linux marks accounts that should never log in with a password by putting an asterisk in their password field in /etc/shadow. Since the asterisk is not a valid hash, no typed password should ever match it. Key-only deployment users, directory users and, on recent Alpine, root itself are set up this way.
In 2016 OpenSSH changed sshd to hash a password attempt even for accounts with no usable hash, so that response times would not reveal which usernames exist. On musl, the crypt() function returns a lone asterisk when it cannot hash its input, including when the password is longer than its 256-byte limit. According to BleepingComputer and the Alpine advisory, that error value then matches the asterisk stored for the account, and the login succeeds. Accounts with real password hashes are not affected.
Who owns the bug is disputed. Ars Technica reports that OpenSSH places the root cause outside sshd while fixing it there, and that musl developer Rich Felker considers it a mistake by the caller rather than a musl bug, though musl plans changes to that mechanism. Researcher Özgün Kültekin of Wakefield found it, and BleepingComputer says he used AI agents to run around 17,600 authentication tests.
Which systems are exposed
Alpine lists the conditions: sshd built without PAM, which is how its standard openssh-server package ships, or the PAM build with UsePAM set to no; password authentication left on, which is the OpenSSH default; at least one account with an asterisk in its password field; and a second account that does hold a $5$ or $6$ password hash. Debian, Ubuntu, Fedora and other glibc systems are not affected, nor are setups using PAM.
Root is protected by the default PermitRootLogin prohibit-password setting, but Alpine and Check Point both note that an attacker who reaches another account with doas or sudo rights can still become root. Alpine's official tiny-cloud images from 3.18.11 through 3.24.3 include an alpine user with no password and passwordless doas. They are safe on first boot but become exploitable as soon as any account gets a $6$ hash, for example when an admin sets a console password. Images configured with cloud-init are not affected, because it turns password logins off.
Containers that do not run sshd are not affected. The discoverer also names OpenWrt, Buildroot and Yocto, though Ars Technica points out that OpenWrt uses Dropbear rather than OpenSSH by default and that the other two are not confirmed. The Register says there is no sign of exploitation so far, and Alpine says no CVE had been assigned.
What to do
- On Alpine, upgrade openssh (fixed in 3.21.10, 3.22.8, 3.23.8 and 3.24.4) and then restart sshd, because upgrading the package does not replace the running daemon.
- On other musl-based systems running OpenSSH, move to OpenSSH 10.6p2 or later.
- If you cannot update yet, set PasswordAuthentication no in the sshd configuration and restart sshd, after confirming key logins still work.
- Search the SSH logs for accepted password logins to accounts that have no password, such as alpine, root or key-only users, and treat any such machine as compromised.
Sources
- OpenSSH flaw lets attackers log into password-disabled Linux accounts BleepingComputer
- Meet *sshole, the vulnerability that lets hackers SSH into Linux devices Ars Technica
- Get root on a musl Linux system by slamming it with an overly long password The Register
- Alpine Linux Security Advisory: OpenSSH-server password authentication bypass alpinelinux.org