The vulnerability occurs because Unix traditionally marks locked accounts with an asterisk, while musl libc has used that exact character since 2012 to signal passwords exceeding hashing limits. When the SSH daemon processes locked accounts to mitigate timing attacks, this matching value inadvertently validates unauthorized logins. The design choice was originally made because the C language cannot enforce null pointer verification on error returns. Stronger type systems found in modern languages like Rust prevent these risks by enforcing explicit result handling over ambiguous in-band sentinel values.
Key points
Using in-band sentinel values instead of proper error variants exposes core infrastructur…: Using in-band sentinel values instead of proper error variants exposes core infrastructure to severe authentication bypass vulnerabilities.
Modern languages like Rust systematically eliminate these vulnerabilities by forcing soft…: Modern languages like Rust systematically eliminate these vulnerabilities by forcing software developers to handle explicit error types.
Relying on legacy C conventions and artificial intelligence assistance continues to perpe…: Relying on legacy C conventions and artificial intelligence assistance continues to perpetuate dangerous error-handling defects across critical software environments.
Sources checked by our analysis pipeline: 1
*sshole, or when are we finally going to get rid of C?
Yet another day, yet another vulnerability in core C code. This one happened due to two different conditions using the same sentinel value:
- On Unix, a password hash of
"*"
has meant a locked account since the very early days. - Since 2012, musl libc’s
crypt
function has returned the string"*"
for a password that’s too long for it to hash.
The two points combined, along with sshd hashing login attempts for locked accounts to avoid timing leaks, mean that on musl systems without PAM (like, oh, the official Alpine AWS image), an unauthenticated user now gets a (possibly root) shell on your computer.
This is not a memory safety vulnerability; rather, it is one of those issues that, people often say, languages with better type systems won’t save you from. This is true! You can very well write a Rust function that returns "*"
if the password is too long. But the big difference between C and Rust in this regard is that the norms of…
Regulators in Brussels are taking aim at recommendation systems that trap young audiences in continuous streams of triggering content covering isolation and body image. Under the Digital Services Act, the platform risks massive financial penalties reaching up to 6 percent if changes are not made. The intervention reflects growing multinational European efforts to curb mental health crises and online harms targeting minors.
Production system administrators are facing severe operational strain after enduring an relentless week of standard updates, public exploit releases, and emergency remediation cycles. This plea directly targets researchers and developers to temporarily hold back security advisories so technology teams can process backlogged tickets. Without a brief respite, operations staff risk acute burnout from unending critical incident response.
Strong developer adoption is accelerating software availability for the new hardware platform, significantly expanding the ecosystem's reach. This steady influx of specialized software aims to improve the overall user experience and validate the device's market presence. The rapid growth also signals that creator interest remains high following the system's launch.