OpenSSH flaw on musl systems lets attackers into password-locked Linux accounts
Servers on Alpine, OpenWrt, Buildroot and Yocto are exposed until they run OpenSSH 10.6p2 or turn off password logins.
A flaw dubbed *sshole lets anyone log into certain Linux accounts that are meant to refuse passwords, by submitting a password longer than 256 bytes. It affects OpenSSH servers on musl-based systems such as Alpine Linux, OpenWrt, Buildroot and Yocto when PAM is not used and password logins are enabled. The bug stems from a 2016 OpenSSH change combined with musl's crypt() returning an asterisk on failure, so a locked account's * matches the returned value. OpenSSH fixed it in version 10.6p2 and Alpine has published fixed packages, while admins who cannot patch immediately can disable password authentication. Researchers reported no exploitation yet, but warned that scanning was likely to follow.
Why it matters
The flaw matters most for operators of small Linux devices and containers built on musl, where accounts that should accept no password can be opened by anyone who knows an account name. Because the attack needs only a name and one oversized password with no retries, scanning for exposed hosts is a short step, so administrators of affected systems have little time to act. Turning off password authentication closes the hole for those who cannot update right away.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.