OpenSSH Flaw Enables Login to Password-Disabled Musl-based Linux Accounts

OpenSSH versions running on Linux distributions that utilise the musl C library are susceptible to a newly disclosed vulnerability that allows attackers to log into accounts where password authentication has been explicitly disabled.

The flaw, identified by security researcher Ozgun Kultekin and dubbed “*sshole,” affects systems such as Alpine Linux, OpenWrt, Buildroot, and Yocto. It specifically targets environments where PAM (Pluggable Authentication Modules) authentication is disabled and SSH password authentication remains enabled.

Technical Root Cause

The issue stems from a combination of a 2016 OpenSSH patch designed to prevent username enumeration (CVE-2016-6210) and the specific behaviour of the musl C library. To prevent attackers from identifying valid usernames through timing differences, OpenSSH was modified to perform password hashing even for accounts that do not have a valid password hash, such as those configured with an asterisk (*) in the /etc/shadow file to block logins.

However, the crypt() function within the musl C library returns an asterisk (*) when a submitted password exceeds the 256-byte limit. In an affected configuration, an attacker can provide an oversized password, causing the library to return an asterisk. OpenSSH then compares this returned asterisk against the asterisk stored in the account’s shadow file, resulting in a successful, unauthorised login.

This vulnerability does not impact accounts with valid password hashes; it only allows access to those specifically configured to block password-based entry.

High-Risk Configurations

The researcher noted that Alpine Linux’s official cloud images for AWS and Azure pose a significant risk. These images often include a default ‘alpine’ account that possesses passwordless ‘doas’ privileges, which could allow an attacker to escalate their access to root.

Systems using the glibc library, including popular distributions such as Debian, Ubuntu, and Fedora, are not affected by this flaw. Similarly, systems that utilise PAM authentication are also protected.

Remediation and Detection

OpenSSH has released a fix in version 10.6p2. Administrators using Alpine Linux are advised to update their packages immediately using the apk upgrade openssh command.

If an immediate update is not possible, administrators can mitigate the risk by disabling password authentication in the SSH server configuration:

PasswordAuthentication no

After modifying the configuration, the SSH service must be restarted.

To identify potential exploitation, administrators should inspect SSH authentication logs for successful password-based logins on accounts that should not permit them. On Alpine Linux, the following command can be used to check for successful logins:

grep "Accepted password" /var/log/messages

If successful logins are found for an account, administrators should verify its status in /etc/shadow. If the password field contains an asterisk but the logs show a successful login, the system may have been compromised.