On certain Linux systems, an attacker could gain root access by entering a password longer than 256 bytes. The vulnerability, dubbed *sshole by Wakefield researcher Özgün Kültekin, who discovered it, can only be exploited in very specific conditions. The flaw affects certain Linux systems using musl libc instead of the traditional GNU C library, and even then only those running OpenSSH's secure shell daemon without Pluggable Authentication Modules (PAM) and with password authentication enabled. If those conditions are met, and at least one other account has a valid password hash, accounts that shouldn't accept passwords, such as root, key-only deployment users, and LDAP users, may be accessed by supplying a password between 257 and 1,024 characters. The targeted accounts must have an asterisk (*) in their password field, and direct root login remains subject to OpenSSH's configuration. That might seem niche, but sorry: It’s not. Musl libc is common in embedded Linux systems due to its low footprint. More critically than that, it's also the standard C library for Alpine Linux, which provides official cloud images for both AWS and Azure. Some Alpine systems running in those environments may therefore be vulnerable, depending on their configuration. The vulnerability in OpenSSH on musl-based Linux systems dates back to 2016, but Kültekin explains that its roots go back much further – to the BSD Unix era, actually. In 1980, Sun Microsystems cofounder and BSD Unix heavyweight Bill...
Get root on a musl Linux system by slamming it with an overly long password
Affected Software
Frequently Asked Questions
Which systems are affected by the sshole vulnerability?
The flaw affects Linux systems using musl libc that run OpenSSH without PAM and have password authentication enabled. It is relevant to accounts with an asterisk in their password field when at least one other account has a valid password hash.
How could an attacker exploit the issue?
An attacker may be able to access accounts that should not accept passwords by supplying a password between 257 and 1,024 characters. The article says a password longer than 256 bytes can enable root access only under the specified conditions.
Does the issue always allow direct root login?
No. Direct root login remains subject to the OpenSSH configuration, even where the other exploitation conditions are met.
Why might this affect more than a small number of systems?
Musl libc is common on embedded Linux because of its low footprint and is the standard C library for Alpine Linux. Alpine Linux also provides official cloud images for AWS and Azure.