Linux bug lets anyone into Alpine with a long password
A flaw combining OpenSSH and musl libc can let an attacker log in to Alpine and some other distros by typing over 256 characters as the password, according to Tom's Hardware.
The facts
- According to Tom's Hardware, typing more than 256 characters at the password prompt can let someone into Alpine and some other Linux distros without a valid password.
- The flaw needs OpenSSH together with musl libc, password authentication not explicitly disabled, no PAM, and one user with a password set using a SHA-512/256 hash. Alpine meets these conditions by default.
- Both OpenSSH and musl author Rich Felker have published fixes and advisories. The source says each seems to blame the other, though it sees the blame as shared.
- The quick mitigation is to set "PasswordAuthentication" to "no" in the OpenSSH configuration file and restart the service.
Case notes · Danny's take
Why it matters
Alpine is a default base for countless containers, cloud VMs and embedded devices, so one flaw in it spreads far. Most of these systems are not exposed to the internet. That is not the comfort it sounds like. An attacker already inside a network, with just one valid user account, can let themselves in. Two projects each doing something slightly wrong is how this kind of hole opens.
For builders
Check your images and servers for Alpine or other musl-based systems running OpenSSH, and apply the fixes from OpenSSH and musl now. Until you have patched, set PasswordAuthentication to no and restart the service. Then audit which internal accounts have passwords at all, because the fix for the next bug starts there.
Not financial advice. Do your own investigation.
This story was summarised with AI from Tom's Hardware's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.