Musl libc allows long passwords to bypass root lock in OpenSSH
Original title: sshhole
Passwords longer than 256 bytes accepted on musl-based SSHD despite * lock in shadow.
The bug in musl libc since 2012 causes crypt() to return * for failed hashes including long passwords. OpenSSH 2016 handling of invalid users combined with this accepts any password on locked accounts. Alpine Docker images and other musl setups were affected until fixes in OpenSSH and Alpine 3.16.
Unconfirmed: Whether the bug was actively exploited before disclosure is unknown
- Crypt() returns * for passwords over 256 bytes on musl
- Root accounts with * in shadow can be bypassed
- Affects Alpine Linux and Docker images
- Fixed in OpenSSH with salt reuse for invalid users
Impact: bypassing locked account authentication
- 1.Test SSH logins on musl systems
- 2.Upgrade to patched OpenSSH
- 3.Check for * in shadow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-6210 | sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not… | 5.9 | 89% |
From the original article
5 min read at sshhole.comso openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
By sshhole.com via serce · sshhole.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.