GoKawiilMusl libc and sshd flaw lets unauthenticated users gain root shell on Alpine-based systems
A vulnerability was found stemming from musl libc's crypt function returning the sentinel string "*" when a password is too long to hash, which collides with the Unix convention that "*" denotes a locked account. Because sshd hashes login attempts for locked accounts to prevent timing attacks, this collision allows an unauthenticated user to obtain a shell—potentially as root—on musl-based systems lacking PAM, such as the official Alpine AWS image.
GoKawiil's interpretation of the reporting above, not reported fact.
The author argues this isn't a memory-safety bug but a design flaw in error handling, the kind that C's lack of algebraic data types and result types tends to encourage through in-band signaling rather than explicit error checking. This suggests that language and ecosystem norms, not just type systems alone, shape how such sentinel-value bugs arise, and that languages like Rust would likely force developers to handle the error case explicitly rather than silently returning a reusable value.
- A sentinel value collision in musl libc's crypt function combined with sshd's locked-account handling can grant unauthenticated shell access on affected systems.
- Systems like the official Alpine AWS image, which use musl without PAM, are particularly exposed.
- The issue highlights how C's lack of built-in error-handling types fosters engineering norms prone to this class of bug, unlike languages such as Rust that enforce explicit error handling.
Source: sunshowers.io, 2026-11-06
Published there as: “*sshole, or when are we going to get rid of C?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.