A 256-character password can unlock some Linux servers

OpenSSH is the free program that most servers use for remote logins. When an admin connects to a server from far away, OpenSSH is usually the doorman.

Musl is a small C library. A C library is a bundle of basic code that nearly every program on a Linux system borrows. Most big distributions, such as Debian, Ubuntu and Fedora, use a larger one called glibc. Alpine Linux, OpenWrt, Buildroot and Yocto use musl instead.

Alpine is popular for containers, which are tiny packaged servers. Its small size is a big part of the appeal.

Linux can lock an account's password. In the file where passwords are kept, the stored fingerprint of the password (a "hash") is replaced by a single asterisk. An asterisk is not a valid hash, so no password should ever match it.

The trouble started in 2016. OpenSSH had a different bug, tracked as CVE-2016-6210, that let attackers guess which usernames exist. They could tell by timing: a real user took slightly longer to reject than a fake one.

To fix that, OpenSSH began doing the password-hashing work even for accounts with no usable hash. That way, every login attempt takes about the same time.

Musl's hashing function also returns an asterisk when it fails, including when the password is longer than its 256-byte limit.

So an attacker sends an oversized password. Musl fails and hands back an asterisk. OpenSSH compares that asterisk to the account's stored asterisk, sees a match and lets the person in.

In real life Imagine a bouncer who checks your ID against a list, and the list says "none" for one guest. If you hand over a card so long that the scanner breaks and prints "none," the bouncer sees two matching "nones" and waves you through.

The researcher says several things must be true at once:

• The system: OpenSSH runs on musl-based Linux, such as Alpine Linux, OpenWrt, Buildroot or Yocto.
• No PAM: PAM, the standard Linux login framework, is turned off. That is the default in Alpine's openssh-server package.
• Passwords on: SSH password login is enabled.
• A locked account: at least one account has an asterisk as its hash.
• A normal account: another account has a valid password hash.

The catch: the flaw does not let anyone skip the password on an account that has a real password hash. It only opens the accounts that were meant to be locked.

Systems that use glibc, including Debian, Ubuntu and Fedora, are not vulnerable. Neither are systems that use PAM.

Alpine ships with the right settings by default. That is why it needs patching first.

The researcher points to one detail that raises the stakes. Alpine's official cloud images for AWS and Azure include a default account named alpine. That account can run commands as the all-powerful root user without a password, using a tool called doas. If an attacker gets into it, they could take over the machine.

Other systems are less exposed. OpenWrt, which runs on many home routers, uses a lighter tool called Dropbear for logins by default, though users can install OpenSSH instead. The bug is also present in Buildroot, Yocto and Void Linux, but not always switched on.

It is also worth noting that most Alpine machines are not reachable from the open internet. Even so, anyone already inside a network, such as a company network, a home lab or a cloud network, could try it. All it takes is one valid account, and scanning for the bug is simple.

OpenSSH says the root cause is outside its own code, in the way the library reports errors. Its release notes call the fix a "critical security workaround" and say the bug is exploitable through the OpenSSH server.

Musl's author, Rich Felker, also published a post. Looking from the outside, both sides seem to see the other as the cause, and the fault looks shared. The bug is the result of two sensible choices that fit badly together.

Özgün Kültekin discovered the flaw and published the details on November 5. He says AI agents, meaning programs that work through tasks on their own, ran about 17,600 login tests, mixing OpenSSH settings, broken password hashes and oversized passwords.

The OpenSSH team has noticed a surge in such reports. Its release notes say many security reports now come from AI models, and that some bugs found by AI are later found independently by other researchers. The team takes that as a sign that attackers who never report bugs can find them too.

So OpenSSH says it will make more frequent releases for now, rather than waiting for a big planned one.

The bug sits between two programs, and each one looked fine alone. OpenSSH added extra hashing in 2016 to close the username-guessing hole. Musl returned an asterisk on failure, which is a legal answer in its own world.

The problem only shows up when a password is longer than 256 bytes, and almost nobody types one by accident.

Testing the two together is what found it. That is what the 17,600 automated login tests did: they tried many odd combinations of settings, broken hashes and oversized passwords.

Alpine is a common choice for Docker and Kubernetes containers, Proxmox setups, cloud servers and embedded devices. That adds up to what could be millions of installs, and many hide inside other software that nobody thinks about.

Most of those boxes are not facing the internet. The risk is an attacker who already has a foothold, for example through one stolen account in a large company, and then walks further in.

What's next: admins now have to find every place Alpine is hiding. Updating the packages is quick, but knowing which containers and devices run OpenSSH with passwords on is the slow part.

The fix is in OpenSSH 10.6p2. On Alpine Linux, admins can update with apk upgrade openssh.

If you cannot update right away, turn off password logins. Set PasswordAuthentication no in the SSH server settings and restart SSH. Key-based logins keep working.

To look for signs of an attack, search the logs for password logins to accounts that should not allow them. On Alpine, grep "Accepted password" /var/log/messages lists successful password logins. If the alpine account shows one while its password field holds an asterisk, that could mean the bug was used.

For another recent emergency fix of this kind, see our story on the PHP flaws patch.

• If you run Alpine or OpenWrt with OpenSSH: update to 10.6p2 today.
• If you cannot update yet: switch off SSH password login and use keys.
• If you use Debian, Ubuntu or Fedora: this bug does not touch you.
• If you run cloud images: check the default alpine account.