OpenSSH flaw could expose locked accounts to unauthorised access on musl Linux

A flaw in certain OpenSSH configurations on musl-based Linux systems could let an attacker gain access to accounts that should not accept password logins, potentially including root. The vulnerability, called *sshole, matters because musl is widely used in embedded systems and is the standard C library for Alpine Linux, which supplies cloud images for AWS and Azure.

Exploitation requires several conditions: OpenSSH must run without PAM with password authentication enabled; an account must have a valid password hash; and the targeted account must have an asterisk in its password field. An attacker can then try a password of 257 to 1,024 characters. OpenSSH fixed the issue in version 10.6p2; systems that cannot be updated can disable password authentication.