OpenSSH sshd password authentication bypass on musl Linux (SSHole)
Alpine·OpenWrt Linux remote login servers let anyone in with a long password!
Summary
The password check in the OpenSSH server (sshd) is bypassed on musl libc Linux systems such as Alpine and OpenWrt when PAM is not used. For some account setups, any password between 256 and 1024 characters succeeds, and public exploit code exists and attacks have been observed.
Affected when
- musl libc-based Linux (Alpine, OpenWrt, Buildroot, Yocto)
- sshd without PAM
- password logins turned on
- accounts whose password field is * (key-only accounts, LDAP accounts, etc.)
What to do
Update to OpenSSH 10.6p2 or later. Until then, set PasswordAuthentication to no in the configuration and restart sshd.
On Alpine Linux, run this to update:
apk upgrade openssh
Can't update yet?
Add this line to /etc/ssh/sshd_config.d/00-no-passwords.conf:
PasswordAuthentication no
A wrong setting can stop the service or lock you out. Check the source links below first.
Then restart sshd.
Products and platforms
CVE IDs
Sources
- Write-up: sshhole.com (opens in a new tab) · sshole.events.greynoise.io (opens in a new tab) · isc.sans.edu (opens in a new tab) · Hackers exploit SSHole OpenSSH flaw to breach Linux systems (opens in a new tab) · Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
- Discussion: *sshole (opens in a new tab) · Hackers exploit SSHole OpenSSH flaw to breach Linux systems (opens in a new tab)
- KISA notice: KISA 보호나라: OpenSSH 보안 업데이트 권고 (opens in a new tab)
Times
First published
First seen