BleepingComputer reported on 5 November that researcher Ozgun Kultekin published a flaw he calls "*sshole". It affects OpenSSH servers on musl-based Linux, such as Alpine Linux, OpenWrt, Buildroot and Yocto. Kultekin says a password of 257 to 1024 characters can open an account meant to refuse passwords. He says the bug dates to 2016.
Kultekin says a 2016 OpenSSH change, meant to stop username guessing by reply timing, now checks passwords even for locked accounts, which store an asterisk. Musl's password function also returns an asterisk when it fails, as it does past 256 bytes. OpenSSH sees a match. It works only without PAM (a common Linux login layer), with password logins on, and when another account has a real password. A fresh box with no passwords set is not affected. The sources do not say whether anyone has used it.
A safeguard added in 2016 became the hole because it relied on how another component reports failure. Kultekin says glibc and PAM setups do not reach that comparison. On Alpine's official AWS and Azure images, he says the default "alpine" account has passwordless doas (a tool like sudo). If the other conditions are met, that could give an attacker root. Leaders can ask which images and devices run musl, whether they use PAM, and whether password logins are on. BleepingComputer says OpenSSH 10.6p2 fixes it.