Ethical Hacking News
A previously unknown vulnerability in OpenSSH has left musl-based Linux systems vulnerable to root access attacks, but OpenSSH has since released a patch to fix the issue.
The Linux community has been reminded of a decade-old vulnerability in OpenSSH that can leave musl-based Linux systems exposed to root access attacks. The vulnerability, dubbed "*sshole", affects systems using musl libc and can be exploited under specific conditions. The vulnerability can be mitigated by disabling password authentication and restarting the SSH daemon. OpenSSH versions 10.6p2 or newer are protected from the vulnerability. The vulnerability serves as a reminder of the importance of keeping software up to date and patches installed.
The Linux community was recently reminded of a decade-old vulnerability in OpenSSH, a widely used secure shell daemon, that can leave musl-based Linux systems exposed to root access attacks. This vulnerability, dubbed "*sshole" by Wakefield researcher Özgün Kültekin, can only be exploited under very specific conditions, but its existence serves as a reminder of the importance of keeping software up to date and patches installed.
The "*sshole" vulnerability affects certain Linux systems that use musl libc instead of the traditional GNU C library. Even then, only those systems running OpenSSH's secure shell daemon without Pluggable Authentication Modules (PAM) and with password authentication enabled are vulnerable. Furthermore, accounts marked with an asterisk instead of a password hash could be busted open by supplying a password longer than 256 bytes – a flaw dating back to 2016.
The vulnerability's roots go back much further, to the BSD Unix era, when Sun Microsystems cofounder and BSD Unix heavyweight Bill Joy was involved in the development of BSD Unix. The asterisk in the /etc/passwd entry for the daemon user effectively disabled password authentication for that account. Today, password hashes typically live in /etc/shadow and contain hashed information that the system uses to verify a plaintext password entered by a user. Asterisks are still present for accounts that aren't supposed to accept password logins, but they are not a foolproof way to keep people out.
Musl libc's developers chose to return a single character for certain failures, and they picked the asterisk. Musl also added SHA-512-based password hashing around the same time, which gets slower the longer a password is, potentially leading to denial of service if someone floods a server with a super-long password. Musl capped passwords at 256 bytes, and it is likely that this is where the vulnerability originated.
In 2016, OpenSSH introduced a workaround to prevent attackers from enumerating valid account names through SSH. Before the change, sshd could reject authentication attempts for nonexistent users more quickly than those for valid accounts. Attempts against valid accounts took longer because the server had to hash the supplied password before rejecting it. The solution was to have sshd perform dummy password hashing for invalid users, using an appropriate hashing algorithm and salt to reduce differences in response times.
Luckily, OpenSSH acted fast to fix this issue, and any OpenSSH build 10.6p2 (released Thursday) or newer is protected. Alternatively, if you can't update your OpenSSH implementation on an affected system, just disable password authentication and restart the SSH daemon and you should be all set.
There's no indication that vulnerable systems have been exploited, but if you want to check, Kültekin has included a simple CLI command in his writeup that can be used to check if any no-password accounts on a sensitive machine recently took a password. This vulnerability serves as a reminder of the importance of keeping software up to date and patches installed. It is crucial to note that it's not a matter of if but when these systems will be exploited, and being proactive about patching and securing them is essential.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Decade-Old-Vulnerability-in-OpenSSH-Leaves-Musl-Based-Linux-Systems-Exposed-ehn.shtml
https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910
Published: Thu Nov 5 14:47:35 2026 by llama3.2 3B Q4_K_M
