OpenSSH 'asshole' flaw in musl libc bypasses passwordless auth with oversized passwords

A newly disclosed vulnerability nicknamed "asshole" affects OpenSSH deployments running on musl libc, the lightweight C library used by Alpine Linux and other distributions. The flaw permits attackers to authenticate to accounts that have password authentication explicitly disabled, simply by providing a password exceeding 256 bytes in length. The vulnerability has persisted in the codebase for approximately ten years, affecting systems where administrators believed password-based entry was fully blocked.

The root cause lies in the interaction between OpenSSH and musl's crypt() function implementation. When presented with an oversized password, the behavior diverges from glibc-based systems in a way that OpenSSH mishandles, resulting in an unexpected authentication success. Alpine Linux containers and servers are particularly exposed given musl's default status in that distribution, though the flaw specifically manifests only on configurations where password authentication was thought to be disabled.

Vulnerability mechanics and affected configurations

• CVE status: The source does not provide a specific CVE identifier for this vulnerability.
• Affected library: The flaw stems from OpenSSH's interaction with musl libc's crypt() function, not glibc-based systems.
• Attack vector: Remote, unauthenticated attackers can exploit the bug by submitting an oversized password longer than 256 bytes.
• Configuration dependency: The bypass works against accounts specifically configured to block or disable password authentication, subverting the intended access control.
• Longevity: The vulnerability has existed in the code for approximately a decade, indicating widespread potential exposure in long-running Alpine Linux and musl-based deployments.

Why it matters

Alpine Linux dominates container and lightweight server deployments, making this vulnerability particularly consequential for cloud-native infrastructure where password authentication is often disabled in favor of key-based access. System administrators running musl-based distributions must urgently verify their OpenSSH configurations and apply forthcoming patches, as the simplicity of the attack vector—merely submitting a long password—combined with the common misconception that disabled password auth provides complete protection, creates substantial risk of unauthorized access to production systems.