Sshole

If you use SSH on Alpine Linux or other musl-based systems and allow password authentication, accounts with '*' in their shadow file can be logged into with long passwords.

A security vulnerability, dubbed "Sshole," has been discovered in OpenSSH when running on systems using the musl C library, such as Alpine Linux. The issue, present since 2016, allows accounts that should not accept passwords to do so if the password exceeds 256 characters. This occurs because musl's `crypt()` function returns an asterisk ('*') for failed password hashes, a behavior intended to prevent crashes but which OpenSSH, when not using PAM, mishandles. Specifically, if an account is configured with a single asterisk in its password hash field (signifying no password or key-only login), OpenSSH on musl systems incorrectly accepts any password longer than 256 characters as valid for that account. The vulnerability was found by Ozgun, who reported that systems like Alpine's official AWS and Azure Docker images are affected by default.

The vulnerability exploits a long-standing interaction between OpenSSH's password handling and musl's `crypt()` implementation. While the asterisk as a placeholder for no password is an old Unix convention, musl's decision in 2012 to have `crypt()` return '*' instead of NULL on failure, combined with OpenSSH's specific handling of this case when not mediated by PAM, created this window. The 256-byte password length limit in musl's SHA512 crypt function, introduced to prevent denial-of-service attacks, inadvertently created the specific condition (password too long -> '*' return) that triggered the vulnerability in OpenSSH.

This issue affects a subset of Linux distributions, particularly those using musl libc like Alpine, OpenWRT, and Buildroot, which are common in containerized environments. Systems using glibc or relying on PAM for authentication are generally not vulnerable. The fix involves updating OpenSSH to version 10.6p2 or disabling password authentication entirely, which is a significant mitigation for many cloud-native deployments. The discovery highlights potential security blind spots in less common libc implementations within specialized environments.