OpenSSH- och musl-libc-buggar öppnar dörren till Linux-system utan lösenord

2026-11-05 • Kategori: Mjukvara

TL;DR: Kombinerad bugg i OpenSSH och musl libc tillåter inloggning utan lösenord på Linux-system med tomma standardlösenord genom att mata in en lång slumpmässig sträng.

The internet is still reeling from the PHP engine vulnerability and all other security vulnerabilities found over the past few weeks, and we're not done. Today's special is quite spicy: you can get into Alpine, OpenWRT, and other Linux distros without needing a password, thanks to a combined bug with OpenSSH and musl libc. Just randomly type over 256 characters on the password prompt and you'll be let in through the SSHhole.It works if you set an empty password for system users, which is the default on multiple distros. The bug is present, though not necessarily enabled, across Buildroot, Yocto, and Void Linux. OpenWRT uses Dropbear for authentication by default, but users can install OpenSSH instead.Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.