OpenSSH and musl flaw lets attackers log in to Alpine Linux

How the bypass works

In simplified terms, a password of that length triggers an error that returns the character "*" to the system. That character is also the marker used for accounts that do not rely on a password, so the login is validated. Other conditions must be met, including a password hashed with SHA256 or SHA512, but these are common on Alpine-based systems.

Other systems built on the same components may also be exposed, such as OpenWrt for routers, and Buildroot and Yocto for connected devices.

The flaw is easy to exploit. Few machines are vulnerable, but it is simple to find those exposing their SSH port to the internet and send them an overly long password. A single connection is enough to tell whether access opens.

Found after ten years

Present since 2016, the bug went unnoticed for a decade until Özgün Kültekin, a researcher at Wakefield, found it with the help of a swarm of AI agents. He compiled sshd in every possible configuration, with glibc and musl, with and without PAM, and then threw what he called "some 17,600 weird connections" at it: odd hashes, broken accounts and far-too-long passwords.

The developers of Alpine Linux and musl have already released a fix, and installing it quickly is strongly advised. If you are unsure whether your devices run Alpine Linux, the safest course is to update your Docker applications, NAS, connected TV or router to the latest system version.