New post: Every link was a fix.
I know, I'm becoming a stuck record on bugs AI found. This one gets a single paragraph on that, and the rest goes on how it happened.
The *sshole bug lets a 257-byte password into an account that's meant to be locked (root, on the wrong Alpine box). Pull it apart and I couldn't find a careless piece anywhere.
The `*` in the password field goes back to 3BSD in 1980 ("The devil himself"). In 2012 musl made crypt() return `*` on failure because callers were crashing. libxcrypt, which now sits under crypt() on most glibc distros, has long used `*0` for the same job, and that one character is most of why glibc distros aren't affected. In 2016 OpenSSH fixed a username timing leak by borrowing another account's salt. And Alpine, after shipping root with an empty password, went to `!` and later `*` so key logins would still work.
Five links, five fixes. musl's guard spent ten years protecting the setting, which wasn't the string being compared. sshd's fix checks the stored field where it's used, which I'd call the lesson, as long as nobody turns it into "trust no one".
The awkward bit: I'd have installed that 2016 fix almost straight away. My Renovate config soaks ordinary updates for three days and lets security advisories straight through. So the class of patch that opened this hole is the one I trust most, and fastest. Is day nought right? Still pondering.
#infosec #alpinelinux #supplychain #softwareengineering
https://phpboyscout.uk/every-link-was-a-fix/