OpenSSH and musl libc flaw lets attackers into Alpine Linux with passwords over 256 characters

How the flaw works

The interaction between OpenSSH and musl libc's crypt() function produces an unexpected result during password verification. musl returns "*" on error instead of the conventional null value, and OpenSSH then compares it against a password hash. An input longer than 256 characters triggers the chain and grants access.

Which systems are affected

Exploitation requires OpenSSH, musl libc, PAM disabled, password authentication left enabled, and a user account with a SHA-512/256 hash. Alpine Linux meets most of these conditions by default. The bug is present but not necessarily enabled in Buildroot, Yocto and Void Linux. OpenWRT uses Dropbear by default, but installing OpenSSH creates the risk.

Why it matters

Alpine is widely used in Docker, Kubernetes and Proxmox containers. While most installs aren't reachable from the internet, attackers inside a network can get in with a single valid user account. Scanning and testing the flaw is trivial.

What to do

Patches for OpenSSH and musl have been published. Systems should be updated immediately. As a quick mitigation, set "PasswordAuthentication" to "no" in the OpenSSH configuration and restart the service.