Musl – OpenSSH password auth bypass analysis

The analysis explains an OpenSSH password-authentication bypass affecting versions before 10.6p2 when built with musl, if PAM is disabled and password authentication is enabled. The flaw involves accounts whose password field contains a short invalid value - conventionally a single space - to disable password logins. To conceal which accounts accept passwords, OpenSSH performs a timing-masking password-hash calculation using another account’s hash. It then compares the result with the disabled account’s stored value, potentially allowing authentication if they match. Musl’s `crypt()` returns a failure token for certain errors; with an excessively long password and a SHA-256 or SHA-512 hash from another account, the calculation can return the same token used to disable the target account. OpenSSH consequently treats the comparison as a successful login.

Exploitation requires several conditions: the target must use the single-space disabled-password value, another account must have a password, and the first such account found must use SHA-256 or SHA-512 hashing. The immediate mitigation is to disable SSH password authentication and restart the server, after confirming public-key access works; Dropbear and other non-OpenSSH software are unaffected. OpenSSH’s fix ensures that accounts with invalid, very short hashes always fail authentication, even after the masking calculation. The analysis characterizes this as incorrect caller handling of `crypt()`, not a musl defect, while noting that musl may change its failure-token convention from a single space to “0” and “1” to reduce risk from similar misuse.