OpenSSH vulnerability allows root access on certain Linux systems

A critical security vulnerability, dubbed “sshole,” has been discovered in OpenSSH and the musl C library that allows attackers to bypass password restrictions and gain root access to Linux servers. Discovered by security researcher Ozgun Kultekin, the flaw has existed since 2016 and affects specific distributions including Alpine Linux, OpenWrt, Buildroot, and Yocto.

The vulnerability occurs when a system is configured to block password logins by replacing the password hash with an asterisk in the configuration file. When a user submits a password exceeding 256 bytes, the musl C function returns an asterisk, which OpenSSH then compares against the stored value, inadvertently validating the entry and granting access.

Risk is particularly high for official Alpine Linux images used on Amazon Web Services and Microsoft Azure, which may contain default accounts with administrative privileges. Systems using glibc, such as Debian, Fedora, and Ubuntu, are not affected. OpenSSH 10.6p2 contains the fix, and administrators are advised to update their packages immediately or disable password authentication as a temporary measure.