Password Bypass Bug in Lightweight Linux Systems Lets Attackers Log In With a Long Fake Password

A researcher has found a flaw in some Linux distributions that lets accounts which should not accept passwords accept one anyway. Security researcher Özgün Kültekin of Wakefield named the bug "*sshole". It affects OpenSSH logins on lightweight distributions built on musl, an alternative to the standard C library. Alpine, which is popular for Docker containers and cloud servers, is one example. An attacker can log in to a passwordless account by supplying any password between 257 and 1024 characters long.

The cause is simple. Passwordless accounts store a single asterisk where a password hash would normally go. When a password is longer than 256 characters, musl's hashing function fails and returns an asterisk as its error message. The OpenSSH server sees an asterisk on both sides and treats it as a match. The attack only works if sshd is not using Pluggable Authentication Modules (PAM), which is the default for Alpine's standard OpenSSH package. The attacker also needs the name of a passwordless account, and the machine must have at least one other account with a real password.

Alpine's official cloud images are more exposed, because their default "alpine" user has no password and can become root without one. Root itself has been passwordless since about Alpine 3.16, but OpenSSH's defaults refuse password logins for root. Alpine containers are only at risk if they run sshd, which most do not. OpenSSH developer Damien Miller urged operators of affected systems to set PasswordAuthentication=no or disable SSH immediately. The flaw developed in stages and was properly introduced in 2016.