Overview
- The vulnerability was publicly demonstrated Thursday and allows a remote attacker to log in to an account whose /etc/shadow password field is '*' by sending a single oversized password between 257 and 1,024 bytes.
- The root cause is musl libc’s crypt() behavior that returns the string '*' on certain failures and on inputs beyond 256 bytes, and OpenSSH built without PAM compares that result directly to the stored '*' marker for no-password accounts.
- This affects Alpine and other musl-based systems running openssh-server without PAM when PasswordAuthentication is enabled and the host has at least one account with a valid $5 or $6 password hash.
- A fix is available in OpenSSH 10.6p2 and Alpine has published patched openssh packages; administrators must upgrade their packages and restart the running sshd process or disable password authentication until they can update.
- Operators should check logs for lines like 'Accepted password for' on accounts that should be passwordless, inspect cloud tiny‑cloud images that ship an 'alpine' user with '*' and passwordless doas, and treat any unexplained successful password logins as possible compromises.