OpenSSH 10.6p2 fixes a password bypass on musl systems such as Alpine when PAM is off

OpenSSH released portable version 10.6p2 on November 5 with what its release notes call "a critical security workaround that affects Linux systems that use the musl libc and PAM disabled": a password authentication bypass reachable through sshd. Researcher Özgün Kültekin, who reported it, explains that to resist username enumeration (CVE-2016-6210), sshd hashes a password guess even for accounts with no usable password, such as key-only accounts whose shadow field is "", using another account's salt. musl's crypt() returns "" when hashing fails, including for passwords longer than 256 bytes, so an oversized password matches the "" and logs in. Exploitation needs password authentication enabled, one "" account and one account with a real password. Alpine's openssh-server does not use PAM by default, Alpine's root is "*", and its AWS and Azure images ship an alpine user with passwordless doas.

Why it matters

Key-only accounts are assumed to be unreachable by password, and this bug breaks that assumption without touching the keys. The failure is a fail-open comparison: the library's error value is the same string the system uses to mean "no password." A fix for one bug, enumeration, became the path for another. glibc systems such as Debian, Ubuntu and Fedora, PAM-based setups and Dropbear are not affected, according to the researcher.

On Alpine, run apk upgrade openssh. Where you cannot upgrade yet, set PasswordAuthentication no and restart sshd; few servers need password SSH at all. To check for use, search logs for "Accepted password" on accounts that should accept only keys. On cloud images, the default alpine user's passwordless doas turns this into root, a reminder to remove standing privilege from default accounts. The Tailscale SSH flaws last week were another SSH trust boundary failure.

Source: OpenSSH release notes, sshhole.com (researcher write-up), BleepingComputer