A vulnerability in OpenSSH allows an attacker to bypass SSH authentication on systems using musl libc compiled without PAM support or with PAM disabled. An attacker can login to any account with an invalid password hash field of '*' by providing a password strictly longer than 257 characters. When crypt(3) in musl libc processes passwords exceeding this length, it returns '*', matching the invalid hash and granting access. The vulnerability is trivial to exploit. The fix involves checking for MIN_PASSWORD_HASH_LEN instead of relying on musl crypt(3)'s default behavior. Setting `PasswordAuthentication no` in /etc/ssh/sshd_config mitigates the issue.
| Vendor | Product | Versions |
|---|---|---|
| openssh | openssh | < 10.6p2 |
Loading…
Added technical details about the '*' hash condition and password length threshold (>257 characters), added CWE-287 and MITRE ATT&CK technique T1110.001 for brute force attacks, added 'sshhole' tag.
Article confirms vulnerability is CRITICAL and identifies Alpine Linux as affected system; added tags for Alpine Linux and 'sshole' identifier.
Added technical details about the authentication bypass mechanism (musl libc, PAM requirement, password length constraints) and marked exploit as available since the vulnerability is described as trivial to exploit.
Initial creation
