PSA for OpenWrt users: If you are getting the post quantum message on login which points to openssh.com, you are likely using dropbear nonetheless. Check in System->Software. I was confused and worried why I seemingly had the vulnerable OpenSSH installed, but its just dropbear using an OpenSSH link.

So AFAIU, you are fine.

Thanks you to the team that found this. Exceptionally well explained and funny at the same time. What is most important is how people just checking stuff( remember the .xz hack that was tried?) has save the internets ass so many times. We should give good security researchers UBI for life for just doing good work.

So, nobody fuzz tested sshd before?!?!

Horrors behind comprehension all around. The code, the error case being “*”, the loose patches plastered over. musl and C are unserious

Managed to reproduce this, with a lab[0] you can play with.

[0] https://github.com/leonjza/sshhole-lab

Repro in a Docker container: https://github.com/predkambrij/sshhole-repro

Was this exploited in the wild?

Reminds one of https://www.openssh.org/txt/buffer.adv.

I desperately want someone to create a single-letter subdomain here.

Not the worst site, but it's clearly a publicity machine from wakefield.co, whom I haven't heard of. Also, exploitation conditions are super narrow, albeit, any password is wild.