The flaw, dubbed "*sshole", has existed in OpenSSH since 2016 and affects only Linux servers that use the musl C library, including Alpine Linux, OpenWrt, Buildroot and Yocto. An account blocked from password logins is marked with an asterisk (*) in /etc/shadow. When a password exceeds 256 bytes, musl's hashing function fails and returns an asterisk, so the comparison with the stored asterisk succeeds. Accounts with valid password hashes cannot be bypassed.
According to Alpine's security advisory, the attack requires the SSH server to check passwords without PAM, password logins to be enabled (the default in Alpine's package) and at least one other account on the machine to have a password. Alpine's official AWS and Azure cloud images include an alpine account with passwordless doas privileges, so under those conditions an attacker can reach root. No exploitation has been reported.
What to do: update the openssh package (apk upgrade openssh) and restart sshd, because the update does not restart it. Admins who cannot update right away should turn off password logins (PasswordAuthentication no). Researcher Ozgun Kultekin, who found the flaw using AI agents that ran about 17,600 tests, also recommends checking SSH logs for password logins to accounts that should not allow them.
