OpenSSH 10.6p2 fixes a password bypass on musl systems without PAM: Reveneau

Why it mattersAdmins on Alpine, OpenWrt or musl Docker images should set PasswordAuthentication to no. The locked root and alpine accounts accept any password over 256 bytes.

OpenSSH 10.6p2 was released with a workaround for a password bypass. The bug affects Linux systems built with musl libc and no PAM support. The release notes name the reporter as Özgün Kültekin. The OpenSSH team says it is releasing the fix fast. It has seen AI agents rediscover bugs within hours of a report.

What the bug does

The bypass sits in musl's crypt function. A user signs in with a password over 256 bytes. Musl's crypt then returns the literal string asterisk. OpenSSH already had a timing-attack mitigation from CVE-2016-6210. It hashes invalid user attempts against a fallback account. That mitigation now compares the asterisk string against shadow entries whose stored hash is also a single asterisk. The two match.

An asterisk in /etc/shadow is the normal way a system marks an account as having no password set. Alpine Linux uses it for its default root and alpine users. OpenWrt uses it for unused service accounts. Many base Docker images carry it by default.

The published write-up on sshhole.com describes the attack. Try to sign in as any user whose shadow entry is a single asterisk. The password must be between 257 and 1024 characters. The report says the bug was found through fuzzing, with 17,600 unusual login attempts across build configurations.

Who is affected

The release notes give the three conditions: Linux, musl libc and sshd built without PAM. A system meeting all three and accepting password logins is exposed. Alpine Linux, OpenWrt, Buildroot, Yocto and musl-based Docker images all meet the first two conditions by default. Alpine's default sshd is built without PAM.

Systems that use glibc are not affected. Systems that run Dropbear instead of OpenSSH are not affected. Systems with PAM compiled in are also safe. Public-key only logins are safe too.

What to do

The one-line workaround is to set PasswordAuthentication no in sshd_config. Then reload sshd. That is the fix on a system that cannot upgrade. Alpine Linux's apk and OpenWrt's opkg should carry 10.6p2 shortly. Check the version. Teams that run musl base images for containers should rebuild them after the upstream package lands.

The OpenSSH release message says the team used to hold reports under an embargo. That gave distributions time to land a fix before public disclosure. The team now rates that cost higher than the gain. AI agents routinely find a bug once a hint is public. The result is faster releases with less coordination.

The write-up on sshhole.com does not assign a CVE identifier. The release notes do not either. Expect one to be issued by a distribution over the next day or two.

Source

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.