Get root on a musl Linux system by slamming it with an overly long password

A vulnerability dubbed ‘sshole,’ discovered by researcher Özgün Kültekin, lets an attacker log in to accounts that should never accept passwords — including root in some configurations — on musl-based Linux systems running OpenSSH without PAM and with password authentication enabled, by supplying a password longer than 256 bytes. The flaw, rooted in a 2016 OpenSSH timing-attack workaround interacting with musl’s password hashing, matters because musl underpins Alpine Linux, which ships official AWS and Azure cloud images. OpenSSH 10.6p2 fixes it; disabling password authentication also works, and there is no indication of exploitation so far.