OpenSSH "*sshole" flaw bypasses password auth on musl-based Linux systems

Affected Systems

OpenSSH versions prior to 10.6p2 on musl-based Linux distributions (Alpine Linux, OpenWrt, Buildroot, Yocto) with PAM disabled, SSH password authentication enabled, and accounts configured with asterisk (*) password hash. Alpine Linux AWS/Azure cloud images with default 'alpine' account are particularly at risk.

Exploitation Status

Vulnerability publicly disclosed with technical details and exploitation conditions documented. No reports of active exploitation yet. Proof-of-concept method described: submit oversized password (>256 bytes) to accounts with asterisk password hash.

Business Impact

Attackers can gain unauthorized access to accounts explicitly configured to block password authentication on affected systems. Alpine Linux cloud images contain a default 'alpine' account with passwordless doas privileges, enabling immediate root access. Debian, Ubuntu, Fedora, and systems using PAM authentication are not affected. Flaw has existed since 2016 but only now publicly disclosed.

Urgency

🟠 Within 24 hours

Recommended Actions

• Update OpenSSH to version 10.6p2 or later on all musl-based Linux systems using 'apk upgrade openssh' (Alpine) or equivalent package manager
• Disable SSH password authentication by setting 'PasswordAuthentication no' in /etc/ssh/sshd_config and restart sshd service if immediate patching is not possible
• Audit /var/log/messages (Alpine) or equivalent SSH logs for 'Accepted password' entries on accounts that should have password auth disabled
• Verify accounts with asterisk password hash using 'grep '^[username]:' /etc/shadow' to confirm no unauthorized password logins occurred
• Review and harden Alpine Linux cloud instances, particularly AWS and Azure images with default 'alpine' account; consider disabling or removing if unused