Critical Vulnerability Allows Root Access via Overly Long Passwords
A flaw in musl libc-based Linux systems enables unauthorized root access through specific password lengths.
1The *sshole Vulnerability Explained
A critical security flaw dubbed *sshole allows attackers to gain root access on certain Linux systems. By supplying a password between 257 and 1,024 characters, unauthorized users can bypass authentication. This vulnerability specifically targets systems utilizing the musl C library instead of the traditional GNU C library, under very specific configuration conditions.
2Specific System Requirements
Exploitation requires several conditions: the system must run OpenSSH without Pluggable Authentication Modules, have password authentication enabled, and contain at least one account with a valid password hash. Furthermore, the targeted account must have an asterisk in its password field, typically indicating that the account should not accept password-based logins.
3Impact on Alpine Linux
While the flaw might seem niche, its impact is significant due to the prevalence of musl libc in embedded Linux environments. More importantly, it is the standard library for Alpine Linux, which provides official cloud images for AWS and Azure. Consequently, some cloud-based Alpine instances may be vulnerable depending on their specific configurations.
4Historical Roots of Failure
The issue stems from how musl libc handles password hashing failures. While the crypt function typically returns NULL, musl returns an asterisk character. This behavior, combined with a 256-byte password limit, creates a security gap. This design choice dates back to 2016, though the underlying logic traces back to early BSD Unix.
5OpenSSH Dummy Hashing Mechanism
In 2016, OpenSSH introduced dummy password hashing to prevent attackers from enumerating valid account names. This mechanism ensures that authentication attempts for invalid users take as long as those for valid users. On affected musl-based systems, this security feature inadvertently facilitates the *sshole attack by processing the excessively long password strings.
6Denial of Service Risks
Beyond unauthorized access, the vulnerability presents a secondary risk. Musl libc uses SHA-512-based password hashing, which becomes computationally expensive as password length increases. An attacker flooding a server with super-long passwords could potentially trigger a denial-of-service condition, exhausting system resources and rendering the server unresponsive to legitimate user authentication requests.
7Immediate Mitigation Strategies
OpenSSH has released version 10.6p2 to address this vulnerability, and administrators should update immediately. If an update is not feasible, disabling password authentication and restarting the SSH daemon effectively mitigates the risk. There is currently no evidence that this vulnerability has been exploited in the wild against production systems or sensitive infrastructure.
8Verification and Future Outlook
Researcher Özgün Kültekin provided a command-line interface tool to help administrators check if any no-password accounts on their machines have recently accepted a password. While the immediate threat is addressed by the latest patch, this incident highlights the risks associated with library-level differences in how critical security functions handle unexpected input.
Original article: The Register — Critical Vulnerability Allows Root Access via Overly Long Passwords