SSH Character Spam Vulnerability
Some implementations of Secure Shell (SSH), one of Linux’s most reliable and secure connection protocols, have been found vulnerable to a surprisingly simple attack: character spam. On certain distributions, typing between 257 and 1024 characters can bypass authentication and grant root access. The flaw affects only a narrow set of systems.
OpenSSH has already released a fix. The release notes state that the security update addresses a critical issue impacting Linux systems that use a disabled musl C library together with PAM (Pluggable Authentication Modules). Specifically, the problem occurs when sshd is built and run without PAM support, allowing password authentication to be bypassed.
SSH itself is a ubiquitous protocol used to manage communications between Linux machines. Anyone who has remotely accessed a Raspberry Pi, a NAS, or used GitHub via SSH has experienced it. The vulnerability, however, does not affect SSH in general, only a few distributions that meet specific conditions.
According to sshhole.com, the issue stems from musl Linux – operating systems that rely on the musl C library instead of the standard glibc. This includes Alpine Linux, OpenWrt, Buildroot, and Yocto. The bug is present only when the SSH server runs on musl, PAM is disabled, password logins are enabled, and an account exists whose password is the single character “*”. Such accounts can be key‑only users, LDAP users, or the root account in Alpine.
Researchers note that users of distributions based on glibc – such as Debian, Ubuntu, Fedora, and others that employ PAM – are unaffected. The complete list of conditions for a vulnerable system includes:
- sshd runs on musl (Alpine, OpenWrt, Buildroot, Yocto)
- PAM is not used (e.g., UsePAM no)
- Password logins remain active (the default)
- An account exists with “*” as its password
- Any other accounts have a real password
Given the limited scope, many users can safely stick with larger, mainstream distributions like Ubuntu or Fedora, or even Windows, which operate in closed‑source environments where such edge cases are unlikely to arise.
