Vulnerability Overview
A critical security vulnerability has been identified that allows unauthorized access to Alpine Linux, OpenWRT, and other Linux distributions. By entering a password longer than 256 characters at the prompt, attackers can potentially bypass authentication mechanisms due to a combined flaw involving OpenSSH and the musl-libc library.
The issue manifests primarily on systems where empty passwords are permitted for users, a default configuration in several distributions. While OpenWRT typically utilizes Dropbear for authentication, the vulnerability remains a risk for users who have manually installed OpenSSH.
Impact on Alpine Linux
Alpine Linux is particularly affected due to its widespread use in containerized environments, including Docker, Kubernetes, and Proxmox, as well as cloud virtual machines and embedded devices. Because Alpine ships with password authentication enabled by default, administrators are urged to prioritize immediate security updates.
Mitigation Strategies
The vulnerability occurs when OpenSSH is used with musl-libc, password authentication is enabled, PAM is not in use, and a user account exists with a SHA-512/256 hash. Beyond applying official patches, administrators can mitigate the risk by setting 'PasswordAuthentication' to 'no' within their OpenSSH configuration file and restarting the service.
Threat Landscape
Although many affected systems are not directly exposed to the public internet, the flaw poses a significant risk within internal networks, including corporate environments, home labs, and VPN-connected infrastructures. The ease of scanning for this vulnerability makes it a high-priority concern for network security.
Both the OpenSSH project and musl-libc maintainer Rich Felker have released advisories and fixes to address the issue, with both parties providing technical insights into the nature of the flaw.
Technical Root Cause
The root cause involves how the musl crypt() function handles error conditions. When returning an asterisk as an error indicator instead of a null value, OpenSSH incorrectly uses this output during password hash comparisons. An excessively long input string triggers this chain of logic errors, leading to the authentication bypass.
