Decade-Old OpenSSH Flaw Could Let Attackers Log In as Root With an Overly Long Password

A decade-old vulnerability, dubbed *sshole, could let an attacker gain access to accounts that should never accept passwords, including root, by entering a password between 257 and 1,024 characters long. It was discovered by researcher Özgün Kültekin and has now been fixed, so affected organisations should patch.

The conditions are narrow. The system must use musl libc rather than the usual GNU C library, run OpenSSH's daemon without Pluggable Authentication Modules (PAM), and have password authentication enabled. At least one other account must also have a valid password hash. Targeted accounts must have an asterisk in their password field, and direct root login remains subject to OpenSSH's configuration. Even so, The Register notes this is not a trivial niche: musl is common in embedded Linux devices and is the standard C library for Alpine Linux, which has official cloud images on AWS and Azure. Some Alpine systems in those environments may therefore be exposed, depending on configuration.

The issue dates back to 2016 in OpenSSH on musl, though Kültekin traces its roots to the BSD Unix era, when an asterisk in a password entry was used to disable password logins. The crypt() function, which creates password hashes for comparison, can fail to compute a hash. Musl's developers chose to return a single character for certain failures, and they picked the asterisk. That choice is central to why the weakness can be abused.