OpenSSH flaw let 257-character passwords unlock Linux accounts

How an asterisk became the key

Servers do not compare passwords directly. They run the password through a mathematical function and compare the result with a stored value. For accounts that must never accept a password, such as root on many systems, Unix convention since 1980 is to store a single asterisk, which no calculation can produce.

In 2012, musl made its hashing function return an asterisk on failure, and it fails whenever a password exceeds 256 characters. Then in 2016, OpenSSH fixed a timing leak that revealed which accounts existed. To equalise response times, it began running the calculation even for locked accounts. A long password therefore produced an asterisk, which matched the asterisk stored for the locked account, and the login was accepted.

Who is exposed

Several conditions must all be met: the server relies on musl (as Alpine, OpenWrt, Buildroot and Yocto do), it does not use PAM, password authentication is enabled (OpenSSH's default), and there is a locked account with an asterisk plus another with a real password. Since Alpine 3.16 in 2022, root is locked exactly this way. On official Alpine images for AWS and Azure, the default account can also gain administrator rights without a password.

Debian, Ubuntu, Fedora and other PAM-based systems are not affected. The researcher says he knows of no active exploitation.

Administrators should install OpenSSH 10.6p2 or, failing that, disable password login.