OpenSSH flaw on musl-based Linux lets an oversized password open password-disabled accounts

A newly disclosed flaw involving OpenSSH and the musl C library lets attackers log in to some Linux accounts that are set up to block password logins. They only need to enter an oversized password. Security researcher Ozgun Kultekin, who found the bug, calls it "*sshole" and published details on Thursday, BleepingComputer reports. It affects OpenSSH servers on distributions that use musl, including Alpine Linux, OpenWrt, Buildroot and Yocto, under certain authentication configurations. Administrators often disable password logins for an account by replacing its password hash in /etc/shadow with an asterisk. Because that is not a valid hash, no password should work. In 2016, however, OpenSSH changed how it handles such accounts to fix a username-enumeration bug, CVE-2016-6210. To keep response times the same, OpenSSH began hashing passwords even for accounts with no usable hash. On musl systems, the way OpenSSH handles password verification errors can turn this into a way to log in. The Hacker News reports that OpenSSH has released an emergency fix. The affected distributions are common in containers, routers and embedded devices, so the flaw may be present in many lightly maintained systems that are reachable over SSH.