Long password strings can give attackers root on some musl-based Linux SSH servers
Operators running Alpine or other musl-based systems with password logins enabled should check their sshd configuration and apply the latest OpenSSH release.
A flaw in certain SSH server setups lets an attacker reach root access by submitting a very long password string, with the reported range being 257 to 1,024 characters. It only affects Linux systems that use the musl C library and run sshd with PAM support turned off, a group that includes Alpine Linux. The bug was found by researcher Ozgun Kultekin and is documented at sshhole.com. OpenSSH has shipped a workaround in its latest release that avoids the password authentication bypass inside sshd, while treating the underlying cause as lying outside sshd itself. Systems on glibc-based distributions such as Debian, Ubuntu and Fedora are not affected under the conditions described, though operators running musl-based servers with password logins enabled should check their configuration and update.
Why it matters
The flaw matters most to people who run Linux servers on musl-based distributions such as Alpine, where sshd has PAM support turned off and password authentication is allowed. For them, a very long password submitted to the SSH login can grant root access, so the exposure is tied to a specific configuration rather than to all Linux systems. Systems on glibc-based distributions such as Debian, Ubuntu and Fedora fall outside the conditions described. OpenSSH's latest release contains a workaround that avoids the bypass inside sshd, though the underlying cause sits outside sshd itself.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.