Hackers Hit OpenSSH ‘SSHole’ Flaw Within Hours: What Canadian Alpine Linux Users Need to Do

The bug comes from two behaviours that are harmless on their own. Accounts with no password store a single asterisk in their password field. When musl’s crypt() function receives a password longer than 256 bytes, it fails and returns that same asterisk, so sshd sees a match and accepts the login. The path dates to a 2016 OpenSSH change that addressed a username enumeration flaw. 
alpinelinux
thehackernews

The conditions are specific, but common on some systems. Password authentication must be enabled, which is the OpenSSH default. The target account must have * as its password field, and at least one other local account must have a $5$ or $6$ password hash. Accounts with valid password hashes cannot be bypassed.

Alpine says the default PermitRootLogin prohibit-password setting protects root directly, but an attacker can still reach root through another account with doas rights.

Previdian’s sensors recorded the first attempt about eight hours after the CVE was published. As of Nov. 8, the firm counted 19 attempts from 12 IP addresses in eight countries. Previdian told The Hacker News it confirmed root access on an Alpine honeypot, where the attacker ran basic reconnaissance commands. Several public proof-of-concept tools have appeared, and the flaw was not listed in the U.S. CISA Known Exploited Vulnerabilities catalogue as of Nov. 8.

What it means for Canada

CSN found no public reports of compromised Canadian organizations and no published count of exposed Canadian hosts. The Canadian Centre for Cyber Security issued advisory AV26-1130 on Nov. 5, urging administrators to apply updates for OpenSSH versions before 10.6p2. The advisory does not mention exploitation, which was reported after it was issued.

Despite its “OpenBSD” title, the advisory should not send OpenBSD administrators scrambling. The researcher says OpenBSD, glibc distributions such as Debian, Ubuntu and Fedora, and systems using PAM are not affected. Dropbear is also unaffected.

Cloud teams face the most subtle risk. Official Alpine tiny-cloud images from 3.18.11 through 3.24.3 include an alpine user with a * password field and passwordless doas. They are safe at first boot, but become exploitable once any $6$ hash exists on the machine, such as when an administrator sets a console password. Containers that do not run sshd are not affected, nor are images configured through cloud-init, which disables password logins.

Teams should also check appliances and embedded Linux builds. The researcher lists OpenWrt, Buildroot and Yocto among the musl-based platforms at risk, although OpenWrt uses Dropbear by default and would need OpenSSH installed separately.

A confirmed login may also carry legal obligations. Under PIPEDA, a breach involving personal information that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner and affected individuals notified. Quebec’s Law 25 sets a similar duty for incidents presenting a risk of serious injury. Bill C-8, which received Royal Assent in June, will require designated operators in finance, telecommunications, energy and transportation to protect critical cyber systems, with the new act’s provisions phased in.

Version numbers alone will not settle exposure. Alpine backported the fix to older OpenSSH branches, so a patched 3.24 system reports 10.3_p1-r2 rather than 10.6p2. Upgrading the package also does not replace the running daemon, so sshd must be restarted.

The case also reflects a wider shift in bug hunting. Kültekin says agent swarms ran about 17,600 test logins against different OpenSSH builds to surface the flaw. OpenSSH’s release notes warn that bugs found with AI tools are being independently rediscovered, suggesting adversaries can find them too.