Tech • AI • Robotics • Game
Well, This Is Bad
7/10TL;DR
A newly disclosed OpenSSH flaw can allow unauthenticated root logins on systems running Alpine Linux, OpenWrt or other musl-based environments with SSHD exposed, password authentication enabled and PAM disabled.
KEY POINTS
Who is affected
The issue is not universal across Linux, but it is serious for a common deployment pattern: lightweight containers and appliances based on Alpine or other musl distributions. Systems are exposed when sshd is reachable over the network, password authentication is turned on, and PAM is not in use. That combination is common in minimal images and embedded setups.
What the bug allows
Under the vulnerable configuration, an attacker can attempt to log in as root and supply a password longer than 256 characters. If the conditions line up, the login succeeds without knowledge of the real password. The practical result is full remote administrative access with no prior foothold.
How the flaw emerged
The bug is the product of several old compatibility and security fixes interacting in an unexpected way. Traditional Unix systems used special password markers such as * to indicate an account should not accept logins. Separately, password-hashing code was changed years later so that oversized password inputs would also yield * instead of failing in other ways.
Why password length matters
Password hashing is computationally expensive, and very large inputs can create denial-of-service risks by consuming excessive CPU. To mitigate that, the underlying crypt behavior in affected environments returns * when a supplied password exceeds 256 characters. In isolation, that was meant to be a safe rejection path.
The OpenSSH interaction
OpenSSH includes separate authentication handling when PAM is unavailable. Earlier hardening work added logic to simulate realistic response times for nonexistent or blocked accounts to prevent username enumeration. Later changes also represented the root password state with * in some non-PAM cases, assuming no valid password hash could ever collide with it.
Why root login can succeed
In the vulnerable path, sshd processes a long password for root, calls the hash function, and receives * because the password is over 256 characters. It then compares that result against the stored value for the blocked root password, which is also *. The string comparison matches, and the attacker is authenticated as root.
Why the flaw stands out
Recent high-profile infrastructure bugs have often required complex exploitation or extended time to produce a visible impact. This one is notable because the exploit path is straightforward once the environment is correctly identified. The underlying mechanics are intricate, but the attack itself can be as simple as trying root with a 257-character password.
Discovery and significance
Security researcher Oskars identified the flaw after large-scale automated testing involving roughly 17,000 unusual login attempts. The finding highlights how security regressions can emerge from individually reasonable fixes spread across many years. It also underscores the risks of minimal container and appliance builds that omit PAM while leaving password-based SSH access enabled.
What administrators should do
Operators using Alpine, OpenWrt or other musl-based systems should urgently review whether SSHD is internet-exposed and whether password authentication is enabled. Immediate mitigations include disabling password logins, disabling direct root login, restricting SSH access to trusted networks, or switching to key-based authentication until patched packages are installed.
CONCLUSION
The flaw shows how a chain of legacy design choices and defensive patches can combine into a critical authentication bypass. For affected systems, the risk is immediate because successful exploitation can hand remote attackers full root control in a single login attempt.
Ask a question