OpenSSH and musl libc Flaw Lets Long Passwords Bypass Authentication

En bref

• Authentication bypass affects OpenSSH when paired with musl libc and PAM
• Passwords between 257 and 1024 characters can be accepted without proper verification
• Some accounts on Linux distributions are exposed; no CVE has been assigned
• Rushed patches are available; administrators should prioritize verification and testing

OpenSSH maintainers are responding to an authentication bypass that involves OpenSSH, the musl C library, and PAM. In affected configurations, the software can accept an arbitrary password instead of validating it against the stored credential. No CVE identifier has been published for the issue, which makes tracking and prioritization more difficult for defenders. Patches are being produced, and some of that work is being done under time pressure.

The exposure is not universal. It applies to Linux distributions that use the affected combination of components, and only some accounts are reachable through the flawed path. The problematic password range is unusually long: passphrases from 257 to 1024 characters can be treated as valid without the expected check. That narrow trigger may help scoping, but it does not reduce the severity for systems that match the conditions.

Authentication bypass is a high-impact class of defect because it can grant access without a legitimate secret. For K-12 and government environments, even a limited set of affected accounts can include privileged or service identities that matter. The absence of a CVE also means some teams may miss the issue if they rely only on vulnerability feeds. Rushed patches add a second risk: incomplete fixes or regressions may require follow-up updates.

Administrators should determine whether their Linux fleet uses OpenSSH with musl libc and PAM, then apply distribution and upstream fixes as they become available. Testing should cover PAM-backed authentication and long passphrases before broad rollout. Watch authentication logs for accepted logins that do not match normal patterns, and for attempts using unusually long passwords. Until patches are verified, reduce SSH exposure where practical and prefer key-based or multi-factor access over password authentication.

À faire maintenant

1. Inventory Linux systems that run OpenSSH with musl libc and PAM; record versions and patch status.
2. Apply vendor and distribution updates for OpenSSH and musl libc as soon as they are available, without waiting for a CVE.
3. Test fixes in staging with PAM authentication and passwords in the 257-1024 character range before production rollout.
4. Monitor SSH authentication logs for anomalous accepted logins and unusually long password attempts.
5. Temporarily restrict SSH access to trusted networks or require key-based or multi-factor authentication where feasible.
6. Review accounts that still permit password authentication and disable that method where operational needs allow.
7. Track maintainer and Linux distribution advisories closely because rushed patches may need revision.

Source originale

SecurityWeek