EXPLORINEER
en

UK — The Register

Get root on a musl Linux system by slamming it with an overly long password

Security1 min read

A security flaw in OpenSSH on some Linux systems that use musl libc could let an attacker get root access. The attacker does this by typing a password that is longer than 256 bytes.

A long password can open the door

Researcher Özgün Kültekin found a bug nicknamed *sshole. On certain Linux systems, an attacker could log in as root by sending a password between 257 and 1,024 characters. The bug is now fixed, so users should install the patch.

Key facts

  • The bug only works on certain Linux systems that use musl libc instead of the usual GNU C library.
  • The system must run OpenSSH's SSH daemon without PAM and with password login turned on.
  • At least one other account must have a valid password hash.
  • The bug has been in OpenSSH since 2016.

Where the bug comes from

The roots of the bug go back to early BSD Unix in 1980. An asterisk (*) in the password file meant that an account could not log in with a password. Today, the asterisk is still used for accounts that should not accept passwords. But it is not a fully safe way to block logins. Musl libc returns an asterisk when password hashing fails, and it caps passwords at 256 bytes. OpenSSH's 2016 fix for hiding which account names exist also made the problem reachable.

Why it matters

Musl libc is common in small embedded devices. It is also the standard C library for Alpine Linux, which has official cloud images for AWS and Azure. Some Alpine systems in those clouds may be at risk, depending on how they are set up.

What to watch

  • Install the OpenSSH update on any system that could be affected.
  • Check whether your servers use musl libc, especially Alpine Linux in the cloud.
  • Check whether your SSH setup matches the conditions described above.

Glossary

OpenSSH
A free tool that lets people log in to computers securely over a network.
musl libc
A small library of basic code that Linux programs use. It is smaller than the usual GNU C library.
PAM
Pluggable Authentication Modules, a system that checks who you are when you log in.
Alpine Linux
A small Linux system often used in cloud servers and containers.
root
The all-powerful admin account on a Linux system.
password hash
A scrambled version of a password that is stored instead of the real password.

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

Matsuya App Restored After 9 Days, With Up to 3x Points as an Apology

Matsuya Foods Holdings announced on November 6 that the Matsuya official app, suspended since October 28 after unauthorized access, has been restored and requires an update to use. Through November 30, the bento reservation service "Matsuya Bento Net" offers double Matsuya Points, and mobile orders earn triple points. The company disclosed on October 30 that about 2.38 million pieces of personal information had been leaked from the app's management system.

SecurityITmedia

Lottery Official Site Suspended After User Passwords Were "Unintentionally Changed"; Scope Under Investigation

The official Takarakuji (lottery) X account said on November 5 that it had confirmed an issue in which users' passwords on the official lottery website were changed unintentionally, and that it had suspended use of the site. It is working quickly to identify the scope and will notify affected users once details are known. As of 10 a.m. on November 6, the site still showed a suspension notice with no restoration timeline, and the "continuous purchase campaign" could not be applied for.

SecurityThe Register

Feds warn grocers: Don't chill on cyber defenses as freezer hacking spree heats up

US federal agencies, including the FBI and CISA, urged owners and operators of industrial smart freezers to disconnect them from the internet, apply patches, and change default passwords. The warning follows hacks of thousands of refrigeration systems at hundreds of grocery stores in Europe since mid-October, which raised temperatures to 50ºC and spoiled food. The article notes no documented attacks on American supermarkets had been confirmed at the time of publication.

SecurityThe Register

Threat actor targets Indian fintechs on weekends when defenders aren’t watching

India's CERT-IN has warned of a "significant escalation" in attacks by an AI-assisted threat actor it calls CRAFTY FALCON, which targets fintechs and payment providers. The group re-targets victims, including after incomplete remediation, and times attacks to holidays and weekends to delay detection. CERT-IN urges better logging, real-time monitoring, keeping test environments off the internet, and 24x7 monitoring.