A critical vulnerability in OpenSSH on musl Linux distributions has existed since 2016, affecting accounts that should never accept passwords. Accounts like root, key-only deploy users, LDAP users, and the default user on Alpine's AWS and Azure images are impacted. The issue allows any password longer than 256 characters to be accepted for these accounts.
The flaw stems from how musl libc handles password hashing; it caps password length at 256 bytes and uses a star character (*) as a fallback when validation fails, which acts as a wildcard that never matches. This has left numerous production systems, including those built with Docker, OpenWRT, and Buildroot, potentially vulnerable to unauthorized access. The bug remained undetected for years, highlighting a long-standing issue in the intersection of OpenSSH and musl libc implementations.
The implications are severe for infrastructure relying on these specific Linux distributions, requiring immediate patching and review of authentication settings to ensure system security. Administrators are urged to update their systems and verify that password policies are correctly enforced across all user accounts, particularly those designated for key-based authentication only.
Source: Hacker News · Summarized by HeadlinesBriefing