Glonce

Hackers exploit *sshole, an OpenSSH and musl flaw, on Linux

securityThe Glonce editorsArs Technica🔥64Glonce rating64Impact70Novelty55Relevance75Surprise55Players15Credibility85
Hackers exploit *sshole, an OpenSSH and musl flaw, on Linux

Hackers are actively exploiting a recently discovered critical vulnerability that lets them log in to privileged accounts on many Linux systems, according to multiple researchers cited by Ars Technica.

The flaw is tracked as *sshole. It arises from the interaction between OpenSSH and a code library known as musl. Linux systems that use both packages and meet certain other requirements can be hacked to give unauthenticated access to high-privilege accounts in a matter of seconds. *sshole became publicly known last Thursday and quickly raised concerns that it could lead to widespread compromise of Linux machines. Four days later, the article says, that prediction shows signs of becoming real.

The evidence comes from the security firm Greynoise. It said on Monday that honeypots it maintains in Southeast Asia have come under attack by a group it tracks as GT10. The group carried out what Greynoise calls "mature intrusions" into those systems, which Greynoise uses to detect attempted or successful attacks in real time. Greynoise then gained access to a GT10 server, which revealed potential other victims and some of the tools used in the campaign.

The backdoor GT10 uses in these attacks contains Chinese language comments and appears to be generated with the use of AI. It is tracked as TAC Agent and supports a wide range of functions, including shell commands, system reconnaissance and persistence. Greynoise also said GT10 installs the Python3 release on machines that don't already have it, because the package is required to run the backdoor.

OpenSSH has released a fix that prevents the attacks from working.

Key facts

  • *sshole arises from the interaction between OpenSSH and the musl code library; affected Linux systems that meet certain other requirements can give unauthenticated access to high-privilege accounts in a matter of seconds.
  • The flaw became publicly known last Thursday; four days later Greynoise reported real attacks.
  • Greynoise says a group it tracks as GT10 conducted "mature intrusions" into its honeypots in Southeast Asia, and a GT10 server it later accessed revealed potential other victims.
  • GT10's backdoor, TAC Agent, supports shell commands, system reconnaissance and persistence; it contains Chinese language comments and appears to be AI-generated, and GT10 installs Python3 where missing to run it.
  • OpenSSH has released a fix that prevents the attacks from working.

Why it matters

A flaw that gives unauthenticated access to high-privilege accounts in seconds is already serious. What changes here is the move from concern to practice: *sshole was public for only four days before Greynoise saw a group using it against its honeypots. The article describes the intrusions as "mature", and the backdoor tooling is already in place, with TAC Agent handling shell commands, reconnaissance and persistence.

Who it affects

Operators of Linux systems that use both OpenSSH and the musl library and meet certain other requirements. The source does not specify those requirements, and it does not name which distributions or devices use musl and are affected, nor how many systems are vulnerable. GT10 also has other potential victims, which Greynoise found on a server it gained access to.

How to use it

The one remedy the source names is the fix OpenSSH has released, which prevents the attacks from working. Administrators can check whether their systems combine OpenSSH with musl and apply the fix where they do. The source does not say which OpenSSH version contains the fix or which versions are affected, so check the OpenSSH release notes for that.

How solid is it

The reporting comes from Ars Technica, which relies on multiple researchers and on a specific Greynoise statement made on Monday. Greynoise's evidence is first-hand: attacks on its own honeypots and access to a GT10 server. The claim that the backdoor appears AI-generated is hedged in the article, and the source does not say how that was determined beyond "appears to be".

Risks and caveats

The source gives no CVE identifier or CVSS score for *sshole and does not say who discovered or disclosed it. It does not attribute GT10 to any country or state; it only says the backdoor has Chinese language comments. It does not say how many victims GT10 has, only that a server revealed "potential other victims". The only confirmed attacks described are on Greynoise's honeypots, so the scale of real-world compromise is unknown.

“mature intrusions”

— Greynoise's description of GT10's attacks on its honeypots, as reported by Ars Technica