Overview
- OpenSSH issued a fix in version 10.6p2 on November 5, and proof-of-concept exploit code appeared hours later enabling rapid scanning and attack attempts.
- The bug occurs when OpenSSH is linked against the musl C library with PAM disabled and password authentication on, because musl's crypt() returns '*' on certain hashing errors and OpenSSH treats that value as a match for '*' password fields in /etc/shadow.
- Primary exposure is on musl-based systems such as Alpine and some Buildroot, OpenWrt and Yocto setups, which are common base images for containers and cloud appliances that may unknowingly run a vulnerable sshd.
- Telemetry firms have reported clustered exploitation and some confirmed compromises that include container and system reconnaissance, cloud metadata queries, attempts to steal keys and hashes, changes to authorized_keys, and at least one installation of a Python 'TAC Agent' implant.
- Operators should install the patched package, restart the sshd process or disable PasswordAuthentication until a restart is possible, rebuild affected container images, restrict SSH access, and hunt logs and images for signs of compromise such as unexpected password logins or new SSH keys.