Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems

Your SSH logins are now potentially vulnerable to passwordless access if you run Alpine Linux with password authentication enabled, and a fix is available.

A critical vulnerability in OpenSSH, dubbed ".*sshole," has been discovered, allowing attackers to bypass password authentication on certain musl Linux systems, notably Alpine Linux. The flaw enables an attacker to log into accounts with no password set (indicated by an asterisk '*' in the password field) by providing a very long password (257-1024 bytes). This exploits a weakness in how OpenSSH handles password hashing when the system contains at least one account with a valid password hash ($5$ or $6$). The vulnerability affects Alpine Linux versions 3.16 through 3.24 and edge, as well as older unsupported releases, provided password authentication is enabled and the system has a passwordless account like root or a key-only user. A fix is available in updated OpenSSH packages, and a workaround involves disabling password authentication.

The discovery of the ".*sshole" vulnerability highlights a significant security oversight in how OpenSSH handles password hashing with the musl libc implementation, particularly when password authentication is enabled. The reliance on borrowing salts from other user accounts and the peculiar behavior of the crypt() function with overly long passwords creates a systemic risk for systems using passwordless accounts. This issue specifically impacts Alpine Linux and potentially other musl-based distributions, underscoring the need for diligent security patching and configuration audits, especially for servers exposed to the internet.

This vulnerability could lead to widespread unauthorized access on affected systems, especially those running older or unpatched versions of Alpine Linux, and may prompt a reevaluation of passwordless SSH setups. Administrators are advised to prioritize updating OpenSSH or disabling password authentication entirely to mitigate the risk. The incident also serves as a reminder of the importance of secure defaults and robust testing for authentication mechanisms across different libc implementations.