OpenSSH Flaw Lets Attackers Log Into Password-Disabled Linux Accounts

A significant flaw in OpenSSH, dubbed 'sshole', has been uncovered that allows unauthorized access to password-disabled accounts on specific musl-based Linux systems. This vulnerability, disclosed by security researcher Ozgun Kultekin, has been present in certain versions of musl Linux, including Alpine, OpenWrt, Buildroot, and Yocto, for around ten years. The issue arises from how OpenSSH processes password verification errors on systems utilizing the musl C library.

The vulnerability stems from a patch introduced in OpenSSH in 2016 to address a username enumeration vulnerability (CVE-2016-6210). This patch changed OpenSSH's behavior, causing it to perform password hashing even when an account's password hash was set to an asterisk (*), which is intended to block password logins. However, the musl C library's crypt() function returns an asterisk when password hashing fails, including when a submitted password is longer than 256 bytes.

This means an attacker can submit a password exceeding the 256-byte limit, causing OpenSSH to compare the returned asterisk against the account's stored asterisk, resulting in a successful login.

It is important to note that the flaw does not enable attackers to bypass passwords on accounts with valid password hashes. Administrators who are unable to apply the patch immediately can mitigate the risk by disabling SSH password authentication in their SSH server configuration and restarting the SSH service. They can also monitor SSH authentication logs for any password-based logins attempted on accounts that should not allow them.

BleepingComputer recommends upgrading OpenSSH as soon as possible to protect against this vulnerability.