Loading vulnerability…
SSHole
SSHole is a password-authentication bypass affecting OpenSSH sshd before 10.6p2 on Linux systems using musl libc without PAM-based password verification. When a target account's stored password field is exactly '', sshd's fallback hashing logic can borrow another account's SHA-256 or SHA-512 password-hash salt. For submitted passwords longer than 256 bytes, musl crypt() returns '' as an error indicator. The vulnerable authentication logic accepts this error value as a successful match against the target account's stored field. An unauthenticated remote attacker can consequently access eligible accounts using an arbitrary password of 257–1024 bytes. Alpine Linux's default OpenSSH server configuration is among the affected environments; exploitation additionally depends on account configuration and SSH access policies.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized SSH access with the targeted account's existing privileges, compromising the confidentiality and integrity of resources accessible to that account and potentially enabling service disruption. Root compromise is possible when password-based root login is explicitly permitted or when an accessible account has passwordless administrative privileges, as in certain Alpine cloud-image configurations using doas. Compromised accounts may expose application secrets and deployment credentials, enabling further infrastructure access. The bypass does not authenticate attackers to accounts with valid password hashes and does not defeat SSH encryption.
If you can’t patch tonight, do this now.
If patching is unavailable, set PasswordAuthentication no and restart sshd after verifying working public-key access and retaining an existing administrative session. Ensure the setting is effective for all relevant users and Match blocks; validate configuration with sshd -t and inspect effective settings with sshd -T. If password authentication cannot be disabled, disable SSH or restrict access to trusted administration networks. Restricting network exposure reduces risk but does not correct the authentication flaw.
Patch, then assume compromise.
Install OpenSSH 10.6p2 or later, or the distribution's package containing the backported workaround, and restart sshd; updating the package alone leaves the running vulnerable daemon active. The workaround rejects password matches when the stored password field is shorter than four characters. Alpine fixed openssh packages are: edge 10.6_p2-r0; 3.24 10.3_p1-r2; 3.23 10.2_p1-r1; 3.22 10.0_p1-r11; 3.21 9.9_p2-r1; 3.20 9.7_p1-r6; 3.19 9.6_p1-r3; 3.18 9.3_p2-r4; 3.17 9.1_p1-r7; and 3.16 9.0_p1-r6. Rebuild and redeploy affected container and cloud images using patched packages. Investigate unexpected successful password logins to accounts intended for key-only access; treat systems as compromised if unauthorized access cannot be ruled out.
4 exploits validated by Mallory's analysis. Hidden: 11 rejected by Mallory's analysis as not a working exploit.
96 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.