Top Tweets for #SSHolE

An OpenSSH bug that took 46 years to ripen! 1980 UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password. 2012 The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead. Guess which one? The same asterisk: *. Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *. 2016 OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time. 2022 Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images. … and the loop closes! You connect over SSH as root (whose shadow entry is *). You type any password longer than 256 characters (e.g. 300 As). crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root. That chain took 46 years (!!!) to complete. Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.

An OpenSSH bug that took 46 years to ripen! 1980 UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password. 2012 The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead. Guess which one? The same asterisk: *. Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *. 2016 OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time. 2022 Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images. … and the loop closes! You connect over SSH as root (whose shadow entry is *). You type any password longer than 256 characters (e.g. 300 As). crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root. That chain took 46 years (!!!) to complete. Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.