sshole: OpenSSH Flaw on Alpine Linux Allows Login Without Password

How the bug works

In Linux, accounts whose password field in /etc/shadow contains an asterisk (*) should refuse ordinary password logins, although other methods such as cryptographic keys can still work. According to Kültekin, the problem appears when OpenSSH checks a password for such an account. Lacking the data it needs, it uses information from another account to run the verification.

If the submitted password is between 257 and 1,024 bytes long, the musl function that processes it returns an asterisk to signal an error. Because the protected account also holds an asterisk, the server treats the two values as a match and grants access.

The researcher traces the origins to separate changes. In 2012, musl changed how it reports certain errors and capped password length to prevent denial-of-service attacks. Four years later, OpenSSH added measures to stop attackers from discovering valid usernames by timing responses. In 2022, Alpine adjusted its administrator account configuration to allow SSH key access. Each fix solved a different problem, but together they interacted unexpectedly.

Who is affected

Running Alpine does not automatically mean being vulnerable. Check Point notes that several conditions must hold at once: OpenSSH runs without PAM, password authentication is enabled, and an account with the asterisk exists. Another active local account must also have a password hash generated with SHA-256 or SHA-512. Systems that disable password authentication or use PAM are not exposed.

The impact can be severe if the compromised account has elevated rights. Alpine cites some official cloud images where the alpine user can run administrator commands through doas without a password. These images are safe on first boot but can become vulnerable if an account with a compatible password hash is configured later.

Exploitation attempts have already been seen. Security firm Previdian says it recorded eight attempts from a single IP address and confirmed one login with administrator privileges on a decoy server.

What to do

OpenSSH released version 10.6p2, and Alpine pushed updates for several branches, including older ones. Maintainers warn that installing patches is not enough: the SSH service must be restarted to load the corrected code. Those who cannot update yet should disable password authentication and restart the service, after confirming that key-based access works.