*sshole, or when are we finally going to get rid of C?

2026-11-06 · 4 min read types shortsYet another day, yet another vulnerability in core C code. This one happened due to two different conditions using the same sentinel value:On Unix, a password hash of “*” has meant a locked account since the very early days.Since 2012, musl libc’s crypt function has returned the string “*” for a password that’s too long for it to hash.The two points combined, along with sshd hashing login attempts for locked accounts to avoid timing leaks, mean that on musl systems without PAM (like, oh, the official Alpine AWS image), an unauthenticated user now gets a (possibly root!) shell on your computer. See this Alpine advisory for more details.This is not a memory safety vulnerability; rather, it is…