Overview
- Researcher Özgün Kültekin publicly disclosed the flaw on Thursday, November 5, and OpenSSH issued emergency release 10.6p2 the same day while Alpine published patched packages, with threat sensors reporting exploitation and a confirmed honeypot compromise within hours.
- The bug appears when sshd, built without PAM on a musl libc system, borrows another account’s salt to hash a login and musl’s crypt() returns '*' for passwords over 256 bytes, so a 257–1,024 byte password can match a stored '*' and grant access.
- A system is vulnerable only if it runs OpenSSH on musl with PAM disabled, has PasswordAuthentication enabled, has at least one account with '*' in /etc/shadow, and has at least one other local account with a $5$ or $6$ password hash.
- Fixes are available in OpenSSH 10.6p2 and Alpine patched packages back to 3.16, and administrators must both install the update and restart sshd or, if they cannot update immediately, set PasswordAuthentication no and restart the service while checking logs for unexpected "Accepted password" entries.
- Certain Alpine tiny‑cloud images ship an alpine user with '*' plus passwordless doas that becomes exploitable once any $6$ hash is added, creating a quick route to root on affected cloud instances and making rapid patching or disabling password login urgent for operators.