musl crypt sentinel clash puts Alpine sshd auth at risk

A November 7 report on the Hacker News front page says musl libc's crypt function has returned the string "*" for overlong passwords since 2012. That return value collides with the old Unix convention of "*" marking a locked account, creating an sshd authentication risk on musl systems without PAM. Using the official Alpine AWS image as an example, the report says an unauthenticated user can get a shell, possibly as root. The author notes this is not a memory-safety bug, and discusses how C's type system cannot enforce NULL return checks and how Rust community norms forbid such in-band sentinel values. No fix or deployment update is given.

Written by AI from the coverage · updated 4 hours ago