Executive Summary
A long-standing logic flaw has been identified in the interaction between OpenSSH and systems using musl libc, most notably Alpine Linux, OpenWRT, and Yocto. The vulnerability arises from how musl's `crypt()` function handles passwords exceeding a 256-byte limit: it returns a "*" character on error. When OpenSSH processes an invalid login for a locked account (historically marked with a "*") on these systems, it may incorrectly match this error string, granting unauthorized access.
The attack chain involves OpenSSH's mitigation for CVE-2016-6210, which attempts to prevent timing attacks by hashing passwords for invalid or locked users using a "borrowed" salt from a valid account. If a target account (such as root on Alpine) is locked with a "*" and the attacker provides a password between 257 and 1024 characters, the resulting hash comparison succeeds, providing full shell access.
This vulnerability is highly critical for organizations using Alpine-based Docker containers, cloud images (AWS/Azure), or embedded Linux distributions. It effectively bypasses intended key-only authentication policies by re-enabling password access for locked accounts if OpenSSH is not configured with PAM.
Key Details
Threat Name
OpenSSH Musl Authentication Bypass
Affects
OpenSSH, Alpine Linux Docker images
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified