Binance founder Changpeng Zhao has warned server operators to patch a critical OpenSSH authentication vulnerability affecting certain Alpine Linux systems, after developers found the flaw had existed for nearly 10 years.
According to an official security advisory, attackers can bypass authentication on affected Alpine Linux servers by supplying a password between 257 and 1,024 bytes long. The vulnerability affects systems running OpenSSH without Pluggable Authentication Modules (PAM), provided password authentication remains enabled and specific account configurations exist. Attackers need to know the username of an account whose stored password field contains an asterisk, indicating no password has been set, and the machine must have another local account with a compatible SHA-256 or SHA-512 password hash. Under those conditions, the server may accept the oversized password even though it does not match legitimate credentials. The advisory states exploitation requires only one connection, without repeated password guesses.
Security researcher Özgün Kültekin of Wakefield identified the vulnerability, naming it “*sshole,” and traced its origins to changes made between 2012 and 2016. The issue stems from musl’s password-hashing function returning an asterisk when passwords exceed its 256-byte processing limit, while OpenSSH can borrow another account’s password salt when checking accounts without valid password hashes.
OpenSSH released version 10.6p2 on November 5 to address the authentication bypass. Alpine Linux published patched packages covering current and older releases, with versions 3.21.10, 3.22.8, 3.23.8, and 3.24.4 containing fixes. Administrators were advised to update packages, restart the SSH service, and review logs for unexpected password-based access. As a workaround they can disable password authentication by setting PasswordAuthentication no.
Some Alpine Linux cloud images from versions 3.18.11 through 3.24.3 are particularly concerning because the default alpine account has passwordless access to the doas utility, allowing commands with administrative privileges. The flaw can extend beyond Alpine to other musl libc distributions including certain OpenWrt, Buildroot, and Yocto configurations. No confirmed exploitation had been publicly reported at the time of disclosure.
