Musl (< 10.6p2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/musl--10.6p2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 20:26:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenSSH: Authentication bypass on Alpine Linuxhttps://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass/Thu, 05 Nov 2026 20:26:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass/An authentication bypass vulnerability in OpenSSH on Alpine Linux allows remote attackers to log in to passwordless accounts by providing a 257-1,024 byte password when password authentication is enabled.A critical vulnerability exists in the openssh-server package on Alpine Linux (and other musl-based systems) when configured without PAM and with PasswordAuthentication enabled. Attackers can bypass authentication for accounts without a set password (marked as * in /etc/shadow) by providing a password string between 257 and 1,024 bytes long. The flaw occurs because the musl crypt() function returns an "unmatchable" value for inputs exceeding 256 bytes, which the OpenSSH authentication logic improperly equates to a successful match when borrowing a salt from another local account.

Impact

Successful exploitation grants unauthorized access to any account without a set password, including key-only users, system accounts like root (if not otherwise restricted), and the default alpine user in certain cloud images. Unauthorized access may lead to privilege escalation if the compromised account has doas or sudo rights. No attacks have been reported in the wild.

Recommendation

  • Update openssh-server to the latest version (e.g., 3.21.10, 3.22.8, 3.23.8, or 3.24.4) via apk upgrade -U -a and restart the SSH service.
  • If patching is not immediate, disable password authentication by setting PasswordAuthentication no in sshd_config or associated drop-in files, then verify with sshd -t and restart the service.
  • Audit /var/log/messages for unexpected "Accepted password" logs for service or key-only accounts.
  • Review doas usage, recently created files, and authorized_keys for signs of post-exploitation activity.
]]>criticaladvisoryvulnerabilityauthenticationlinux