Binance founder Changpeng Zhao, known as CZ, has warned server operators to patch a critical OpenSSH authentication flaw affecting certain Alpine Linux systems. The vulnerability has existed for nearly 10 years and could let attackers access some accounts without knowing the correct password.
CZ shared the warning on X on November 6, after OpenSSH and Alpine Linux released fixes the previous day. He urged administrators to apply the updates if they had not already done so.
What the OpenSSH flaw does
The issue affects some Alpine Linux servers that use password authentication without Pluggable Authentication Modules, or PAM. Under specific conditions, an attacker can log in by sending an oversized password between 257 and 1,024 bytes long.
The attacker must know a valid username for an account whose stored password field contains an asterisk, which indicates that no password has been set. The server must also have another local account with a compatible SHA-256 or SHA-512 password hash.
When those conditions are met, the server may accept the oversized password even though it does not match real credentials. According to the advisory, exploitation requires only one connection and does not involve repeated password guessing.
Not every Alpine server is exposed
The flaw does not affect every Alpine Linux deployment. Systems using PAM for password checks, servers with password authentication disabled, and containers without a running SSH server are not vulnerable.
The issue can also affect other Linux distributions that use musl libc, including some OpenWrt, Buildroot, and Yocto configurations. OpenWrt commonly uses Dropbear for OpenSSH, which the researcher said is not affected by this particular bug.
CZ’s warning highlighted the risk to crypto companies and other online businesses that operate Linux servers. However, neither his post nor the security notices said Binance systems had been compromised through the flaw.
How researchers found a 10-year-old bug
Security researcher Özgün Kültekin of Wakefield identified the vulnerability and named it “*sshole.” He traced its origins to changes made between 2012 and 2016.
Kültekin explained that musl’s password-hashing function returns an asterisk when a password exceeds its 256-byte processing limit. OpenSSH can borrow another account’s password salt when checking accounts without valid password hashes. Together, those behaviors can make an invalid login appear valid.
He linked part of the problem to an OpenSSH change introduced in July 2016 to address a separate issue involving username discovery. OpenSSH acknowledged the vulnerability but said the root cause was outside the SSH server itself.
Cloud images could face root access
Certain Alpine Linux cloud images raise a more serious concern because the exposed account may already have administrative permissions. The advisory identified tiny-cloud images from versions 3.18.11 through 3.24.3 as potentially affected.
These images are not vulnerable immediately after their first boot. But adding an account with a compatible password hash can create the conditions needed for exploitation.
If an attacker gains access to the default alpine account, they could use its passwordless access to the doas utility to run commands with administrative privileges. That could lead to full root access on the affected machine.
How to patch the vulnerability
OpenSSH released version 10.6p2 on November 5 to address the authentication bypass. Alpine Linux also published patched packages for current releases and older versions going back to 3.16.
Administrators should update affected packages and restart the SSH service. Installing the update alone does not replace a running SSH process.
Alpine identified versions 3.21.10, 3.22.8, 3.23.8, and 3.24.4 as releases containing the fixed packages. Operators who cannot update immediately should disable password authentication by setting PasswordAuthentication no, then restart sshd after confirming that SSH key access works.
Check logs for signs of misuse
Alpine advised administrators to review SSH authentication logs for unexpected password-based access to accounts that should not accept passwords. This is especially important for servers exposed to the public internet.
The advisory said operators who cannot rule out unauthorized access should treat the affected machine as compromised. That may require rotating credentials, inspecting running processes, rebuilding affected systems, and checking for unusual administrative activity.
Why it matters for crypto infrastructure
The warning comes during a period of heightened security concern in crypto. On November 5, CZ also warned users about a fraudulent Trust Wallet website designed to trick people into connecting their wallets.
For exchanges, node operators, and blockchain companies, server security is a foundational defense. A vulnerable SSH configuration can expose administrative access, customer data, private infrastructure, or wallet-related systems if attackers reach sensitive machines.
The lesson is simple: patch quickly, disable password login where possible, use SSH keys, and monitor authentication logs. Those basic steps can prevent a decade-old software flaw from becoming a serious security incident.
