Long passwords can grant root on some musl Linux systems

Even then, exploitation needs more conditions: at least one other account must have a password hashed with SHA256 or SHA512, and the targeted account must have an asterisk in its password field. That covers accounts that should never accept passwords, such as root, key-only deployment users and LDAP users, which can be reached with a password of 257 to 1,024 characters. Direct root login remains subject to OpenSSH's configuration.

Niche as that sounds, musl is common in embedded Linux thanks to its small footprint, and it is the standard C library for Alpine Linux, which publishes official cloud images for AWS and Azure. Some Alpine systems in those environments may therefore be vulnerable, depending on configuration, and other distributions using the same OpenSSH and musl setup may be affected too.

The bug's roots are old. Asterisks in the password field date back to BSD Unix in 1980, where they disabled password authentication for accounts such as the daemon user. Musl's crypt() implementation returns an asterisk for certain hashing failures, and OpenSSH's 2016 change to hash passwords for invalid users, designed to stop account-name enumeration, is what opened the door on asterisk-marked accounts.

OpenSSH fixed the issue quickly: version 10.6p2, released Thursday, is protected. On systems that cannot update, disabling password authentication and restarting the SSH daemon closes the hole. There is no indication vulnerable systems have been exploited, and Kültekin's writeup includes a command to check whether no-password accounts on a machine have recently accepted one.