Get root on a musl Linux system by slamming it with an overly long password

A pair of software bugs affecting the OpenSSH and musl-libc libraries have created a security flaw allowing unauthorized access to various Linux distributions, including Alpine, OpenWRT, and others. By simply typing over 256 characters as a password, an attacker can bypass the authentication process and gain access to the system.

This issue is particularly concerning for Alpine Linux, as it is often used as the default choice for many installations, including Docker/Kubernetes/Proxmox containers, servers, cloud VMs, and embedded devices.

The vulnerability stems from a combination of factors: OpenSSH, musl, password authentication not disabled, not using PAM, and the presence of a single user account with a set password using a SHA-512/256 hash. Once an attacker exploits this vulnerability, they can access the system without needing any credentials, regardless of whether the target system is connected to the internet or not.

In fact, any individual with a valid user account within a network can potentially exploit this flaw, making it a significant concern for organizations with large user bases.

The developers of OpenSSH and musl-libc have released patches and advisories to address the issue, but it is crucial for system administrators to apply the updates as soon as possible to mitigate the risk of unauthorized access. A simple mitigation strategy involves explicitly setting PasswordAuthentication to "no" in the OpenSSH configuration file and restarting the service.

However, this may not be feasible for all environments, particularly those that require password authentication for security and access control purposes.

In summary, the combined OpenSSH and musl-libc bugs present a serious security risk to numerous Linux distributions, primarily affecting Alpine Linux and other popular systems. System administrators should prioritize applying the recommended patches and mitigations to prevent potential unauthorized access and protect their networks and systems from exploitation.