An old SSH password convention and three later changes combined into a bypass, a podcast says

A speaker on the Low Level show, in the episode "SSH situation is insane", walked through a login flaw in some SSH servers. SSH is the standard tool for logging in to remote machines. The speaker described a 1980 convention and three later changes. Together, he said, they let an attacker in without the right password.

What was said

In 1980, a star in the password file marked an account with no password. Because a star is not a valid hash, nobody could log in as that account.

In 2012, musl, a small C library that some systems use, changed its password-check function. On an error it used to return nothing, which many programs never check, so it began returning a star. He said the two values should never be compared.

In 2016 came a fix for a timing attack. Attackers could tell real usernames from fake ones, because a missing account failed fast. The fix made missing or password-less accounts borrow another account's hash and do the same slow work.

Then a very long password made that routine fail. The failure returned a star, and the star matched the star stored for the password-less account. The speaker noted "it is not a buffer overflow." In his words, "that failure will cascade into a star that is then the hash for the other users."

He dated the bug to 2016 on musl systems with a star account. He said Alpine Linux has been broken only since 2021. That year it changed its locked-account marker from a bang to a star, because the bang broke a login-module system called PAM. He said Alpine's Docker image is vulnerable by default.

Why it matters

Our reading: the 1980 star is an old convention that every later fix had to respect.

The 2012 change assumed the two values would never meet. Nothing in the excerpts says anyone checked that against later changes.

For managers, the question is who owns checking each new change against old assumptions. The excerpts put no figure on the cost.

The other side

The flaw needs several conditions at once. The speaker listed password login on, no PAM, an account with a star, and a second account with a SHA-512 password. The more common GNU C library is not affected, he said, nor are builds that use PAM.

The speaker also described an argument that word lists have never held 300-letter passwords. The excerpts do not say who made it, or whether the flaw has since been fixed.

He said Rust would not clearly have prevented it. Better error types might have helped, but this was not a memory-safety bug. The ten-year figure is his rough count from 2016.