OpenSSH on musl bug: any password over 256 chars logs into root since 2016
Yamapama · x · 2026-11-05
A serious auth bug affecting musl-based Linux (Alpine, OpenWrt, Buildroot, Yocto, many Docker images) since 2016: accounts that should never accept passwords (root, key-only deploy users, LDAP users) accept any password longer than 256 characters.
The writeup traces the full causal chain: the no-login field dating to 1980 BSD; the POSIX spec saying crypt() returns NULL on failure; programs that never check NULL; and musl's 2012 change to return a single-char placeholder instead — which OpenSSH's long-password path ends up comparing successfully, letting any password through.
Affects production servers and countless container images; affected systems should upgrade and disable password auth.
More from Infra
- Malaysia Approves 117 Data Centers, Power Demand to Hit 9GW in Five Years — basedjensen · 2026-11-06
- TWiAI Podcast: Altman's DRAM Complaint and Bittensor Subnets — markjeffrey · 2026-11-06
- Splitting one 27B across two 3090s was slow: one model per GPU hits 243 tok/s combined — StewartalsopIII · 2026-11-06
- Shawn Hymel's new tutorial: using Meshtastic devices as IoT sensor nodes with Python — ShawnHymel · 2026-11-06
- UBS: Aspeed Has Secured 2027 BMC Orders on Strong Agentic AI Server Demand — BenBajarin · 2026-11-06
- Firecracker VM escape disclosed: researchers claim root execution on the host — moyix · 2026-11-06