OpenSSH flaw lets oversized passwords log into password-disabled musl accounts

Security researcher Ozgun Kultekin published details on November 5 of a flaw in OpenSSH that lets someone log in to accounts whose password hash is set to an asterisk in /etc/shadow, which is how admins block password logins. The trick is to send an oversized password.

The chain is fiddly. A 2016 OpenSSH patch for a username enumeration bug, tracked as CVE-2016-6210, made the server hash a password even when an account has no usable hash. On musl, the C library's crypt() also returns an asterisk when hashing fails, including when the submitted password goes past its 256-byte limit. The server then compares that asterisk against the stored asterisk and lets the login through.

It only works on musl-based systems (Alpine Linux, OpenWrt, Buildroot, Yocto) with PAM authentication disabled, SSH password authentication enabled, at least one asterisk-hashed account and another account with a valid hash. glibc systems and PAM setups aren't affected. Accounts with real password hashes can't be bypassed this way.

Kultekin says Alpine's official AWS and Azure cloud images ship an affected default 'alpine' account with passwordless doas privileges, which could mean root.

The fix is in OpenSSH 10.6p2; on Alpine, apk upgrade openssh. If you can't patch yet, set PasswordAuthentication no and restart SSH. Otherwise, grep your SSH auth logs for password logins to accounts that shouldn't allow them, and check whether those accounts have an asterisk in the password field. Kultekin found the bug with AI agents running about 17,600 authentication tests. We'd patch the cloud images first.

CVE references

CVE-2016-6210