Musl libc '*' sentinel enables unauthenticated shell on Alpine sshd
Original title: *sshole, or when are we finally going to get rid of C?
Unauthenticated users gain shell access on musl-based Alpine AWS images due to crypt function behavior and sshd handling.
Musl libc returns '*' for password hashes too long to process. sshd hashes login attempts for locked accounts to avoid timing leaks. On musl systems without PAM like the official Alpine AWS image, this allows unauthenticated shell access. The issue arises from C's use of in-band sentinel values for errors, unlike Rust's error types.
- Affects Alpine AWS images
- No PAM required for exploitation
- Not memory safety issue
- C norms permit '*' sentinel
- Rust norms forbid it
Impact: unauthenticated shell access
| Product | Affected |
|---|---|
| musl libc | — |
From the original article
3 min read at sunshowers.io
Original art by Genildo Ronchi. Yet another day, yet another vulnerability in core C code. This one happened due to two different conditions using the same sentinel value: On Unix, a password hash of "*" has meant a locked account since the very early days.
By sunshowers.io via novedevo · sunshowers.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.