Get root on a musl Linux system by slamming it with an overly long password
Decade-old vulnerability in OpenSSH is now fixed, so get a-patchin'
A vulnerability dubbed *sshole in OpenSSH on Linux systems running the musl libc, which is common in embedded Linux systems, allows attackers to gain root access under very specific conditions. Musl libc, the standard C library for Alpine Linux, which provides official cloud images for AWS and Azure, has a flaw that dates back to 2016.
It affects systems running OpenSSH without Pluggable Authentication Modules (PAM), with password authentication enabled, and at least one account with a valid password hash. Attackers can exploit this by entering a password between 257 and 1,024 characters, provided the targeted accounts have an asterisk (*) in their password field.
Password authentication remains subject to OpenSSH's configuration, which might seem niche but is not. Musl libc caps passwords at 256 bytes, but returning a single character for failures can lead to denial of service if someone floods a server with a super-long password. OpenSSH fixed this issue in version 10.6p2 (released Thursday), and disabling password authentication should also protect affected systems.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Alpine Linux Security advisory: OpenSSH-server password authentication bypass alpinelinux.org
- Get root on a musl Linux system by slamming it with an overly long password theregister.com
- Combined OpenSSH and musl-libc flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password tomshardware.com
- Critical security vulnerability affects OpenSSH on Alpine Linux systems lwn.net
