Overview
- Security researcher Özgün Kültekin disclosed the bug and OpenSSH released a fix on Thursday, and proof-of-concept and working exploit code appeared the same day.
- The flaw happens when musl libc’s crypt() returns an asterisk for oversized inputs and OpenSSH mistakes that value for a stored password hash, which lets 257–1024 byte passwords succeed against accounts with '*' in /etc/shadow.
- Multiple firms including GreyNoise, Previdian and watchTowr have observed active exploitation attempts and some confirmed breaches that included reconnaissance, theft attempts for SSH keys and password hashes, and installation of a TAC Agent implant.
- Vendors have released patched OpenSSH packages (10.6p2 and distribution updates) and administrators are urged to install fixes, restart sshd or temporarily disable PasswordAuthentication and audit logs for unexpected 'Accepted password' entries and new authorized_keys.
- The bug mostly affects musl-based systems such as Alpine and many tiny cloud images, which means container images and cloud instances can inherit the weakness and increase the risk to service operators and their users.