OpenSSH Authentication Bypass on Alpine Linux

A critical vulnerability has been identified in OpenSSH (sshd) when running on Alpine Linux and other musl-libc based systems. The flaw allows remote attackers to bypass authentication and gain access to accounts that have no password set (e.g., SSH key-only accounts, default 'root' or 'alpine' accounts) by providing a password between 257 and 1,024 bytes long. This occurs because musl's crypt() function returns a specific error character '*' for long inputs, which unexpectedly matches the placeholder used for passwordless accounts.

The vulnerability is highly exploitable, reportedly succeeding on every attempt with a single connection if four specific conditions are met: the system uses OpenSSH without PAM, password authentication is enabled, at least one account is passwordless, and at least one other account has a valid $5$ or $6$ SHA-based hash. While no active exploitation has been reported, the OpenSSH team bypassed traditional long embargo periods due to concerns that AI-driven vulnerability discovery could lead to rapid exploitation by adversaries.

Impacted systems include Alpine Linux versions 3.16 through 3.24 (when running openssh-server) and potentially other musl-based distributions like OpenWrt, Buildroot, and Yocto if OpenSSH is manually installed. Business impact is high for organizations relying on Alpine-based cloud images or containers where SSH access is exposed and default configurations remain unchanged.