OpenSSH developers published an emergency update to OpenSSH 10.6p2, which adds protection against a critical vulnerability (CVE not assigned), which received a code name “SSHole” and allows you to bypass authentication. On systems with the Musl library, the vulnerability allows you to connect to a user for whom no password has been set by entering any password containing more than 256 characters. The issue affects Linux distributions that use the musl standard library but do not use PAM (Pluggable Authentication Modules), such as OpenWRT, Alpine, Buildroot and Yocto. A particular danger is that password login is often blocked for the root user, which makes it possible for anyone to connect remotely with administrator rights.
The error leading to the vulnerability is not in the OpenSSH code, but is exploited through sshd. At the same time, due to the seriousness of the problem, version OpenSSH 10.6p2 offers a workaround for blocking the vulnerability. Owners of affected systems are advised not to wait for updates to appear, but to immediately disable password authentication via the “PasswordAuthentication no” parameter in /etc/ssh/sshd_config or disable SSH completely.
The problem does not occur on non-Linux and glibc-based Linux environments, or on systems that use PAM for password authentication. The fix is already available in Alpine and OpenWRT.
The vulnerability is due to incorrect interaction between OpenSSH and the crypt() function from musl. To protect against determining the existence of users by analyzing differences in request processing time, since 2016 OpenSSH, when checking passwordless accounts, uses the standard password verification procedure – calls the function “crypt (passed password, salt)” c salt another user who has a valid password hash, and then compares the hash returned by the crypt function with the value from the password hash field.