Overview
- OpenSSH issued a fix in version 10.6p2 on Thursday, Nov. 5, and proof-of-concept exploit code appeared within hours of the patch.
- The bug occurs when musl’s crypt() returns an asterisk for oversized passwords and OpenSSH treats that value as a match for accounts whose /etc/shadow password field is '*'.
- Only specific setups are vulnerable: OpenSSH linked against musl with PAM disabled, at least one $5/$6 (SHA-256 or SHA-512) hashed password present, and one or more accounts marked '*' to block password logins.
- Security firms report accelerating scanning and successful intrusions that include root logins, cloud metadata queries, attempts to steal SSH keys and password hashes, and installation of a Python 'TAC Agent' implant.
- Operators should install OpenSSH 10.6p2 or vendor fixes, then restart sshd or disable PasswordAuthentication if they cannot patch, rebuild any affected container images that use musl-based bases, and search logs and authorized_keys for signs of compromise.