46 years in the making: how a '*' in crypt() led to OpenSSH auth bypass (*sshole)
OwariDa · x · 2026-11-09
A newly disclosed OpenSSH vulnerability dubbed sshole lets attackers authenticate to locked accounts with any password of 257–1024 bytes on musl libc systems (Alpine Linux, OpenWrt, Buildroot, Yocto) where PAM is disabled and password auth is enabled.
The root cause spans decades: UNIX used in password fields since 1980 to mark uncrackable locked accounts; in 2012 musl libc changed crypt() to return the error string instead of NULL on failure (plus a 256-byte limit in 2016-era hardening); OpenSSH's 2016 CVE-2016-6210 timing fix made hashing uniform; and Alpine's 2022 switch from ! to for locked root passwords completed the chain — making the error string look like a valid hash and enabling passwordless access.
More from Safety
- Sovereign Agents paper warns open-ended goals could cause irreversible AI loss of control — LuizaJarovsky · 2026-11-09
- Berkeley-led working group: a hardwired decade-long pause of frontier AI is feasible — DavidSKrueger · 2026-11-09
- Yoshua Bengio: we should just stop training the most advanced AI models — DavidSKrueger · 2026-11-09
- March for an AI Treaty: protests in six cities on Nov 14 call for banning ASI — DavidSKrueger · 2026-11-09
- Perplexity Computer gains Cloudflare Security Audit skill that traces vulns entry-to-sink — jeffgrimes9 · 2026-11-09
- UK rejects calls to slow down AI development — mark_k · 2026-11-09