Updated

Updated · ZDNet · Nov 7

Alpine Linux Patches OpenSSH Auth Bypass in 3.24.4 as 257-Byte Passwords Unlock Accounts

Updated

Updated · ZDNet · Nov 7

Alpine Linux Patches OpenSSH Auth Bypass in 3.24.4 as 257-Byte Passwords Unlock Accounts

Q: Are other services beyond OpenSSH secretly vulnerable to this bizarre musl library authentication bypass?

Yes—but only in a narrow class of services, not as a broad hidden internet-wide flaw. The bypass is fundamentally an interaction between musl’s `crypt()` behavior and applications that do their own password verification against shadow-style fields. If another program on musl-based Linux compares the result of `crypt()` directly to a stored `*` field for a passwordless account, it could hit the same failure mode. That means the risk is not theoretically unique to OpenSSH. But the evidence so far points to OpenSSH’s non-PAM path as the main real-world exposure. OpenSSH maintainers, Alpine, and outside researchers all describe this as exploitable through `sshd` when PAM is disabled, password authentication is on, the target account has `*` in `/etc/shadow`, and another local account has a `$5$` or `$6$` hash. PAM-based setups, glibc systems, non-Linux platforms, and Dropbear are not affected. Researchers and vendor advisories also flag other musl-based environments to review—such as custom OpenWrt installations using OpenSSH, Buildroot, and Yocto images—but that is still essentially the same OpenSSH bug surfacing on other musl systems, not proof that many unrelated daemons are silently vulnerable. So administrators should not assume “everything on musl is broken.” They should assume any musl-linked service that performs password checks itself, without PAM, deserves audit attention—especially embedded or custom software—but OpenSSH is the confirmed urgent case today.

3 articles · Updated · ZDNet · Nov 7

Alpine shipped fixes in 3.21.10, 3.22.8, 3.23.8 and 3.24.4, plus backported packages to 3.16, for CVE-2026-123158 and warned admins to restart sshd after upgrading.
A 257- to 1,024-byte password can log into password-disabled or key-only accounts on musl-based systems because crypt() returns "*", which matches those accounts' password field when OpenSSH runs without PAM.
Every checked Alpine release was affected—3.16 through 3.24 and edge—if PasswordAuthentication was enabled and at least one other account had a 5 or 6 hash; Debian, Ubuntu and Fedora are not exposed.
Tiny-cloud images 3.18.11 through 3.24.3 are a standout risk because an alpine user with passwordless doas can become reachable once any hashed-password account exists on the machine.
Alpine told administrators to search logs for "Accepted password for" on no-password accounts and to treat any unruled-out login as a full compromise.