In 1980, Bill Joy put an asterisk in /etc/passwd for the daemon account on 3BSD. The convention was elegant: since isn't a valid password hash, no password can ever match it, so the account is permanently locked. Unix systems still use this convention 46 years later. It is one of the oldest living assumptions in computing security. In August 2012, musl libc — the lightweight C library underpinning Alpine Linux, OpenWrt, Buildroot, Yocto, and a substantial fraction of the world's Docker images — made two commits twenty days apart that created a collision course. First, commit b3c4cc12 changed crypt() to return '' instead of NULL on failure, preventing crashes in programs that never checked for NULL. Then commit 88bf5a8a added SHA-512 support with a 256-byte password cap, causing crypt() to fail (and therefore return '') on any password longer than 256 characters. When the stored password field is also '' — the universal Unix lock — any oversized password matches. The attack path is specific but alarmingly common: OpenSSH running on musl without PAM, with password authentication enabled (the default), where at least one account has '' as its password field and at least one other account has a real password hash. That last condition matters because of CVE-2016-6210's fix — when sshd encounters a user without a real hash, it borrows another account's salt and hashes anyway to prevent timing-based user enumeration. On musl, that borrowed-salt hash of a 257+ character password returns '', which matches the stored ''. The locked door opens. Alpine's official AWS and Azure cloud images ship with the default 'alpine' user configured exactly this way, with a '' password and passwordless doas (sudo equivalent). So the bypass doesn't just grant user access — it grants root. Every Alpine container and VM running OpenSSH without PAM has been potentially vulnerable since 2016, when the timing-fix interaction completed the chain. The vulnerability sat in plain sight for a decade. A Debian developer asked glibc to adopt musl's '' return in 2013 — Debian later moved to libxcrypt, which returns '0' instead, dodging the bug by a single character. A December 2024 musl mailing list thread discussed busybox passwd breaking on 257-character passwords — the same root cause — without anyone connecting it to sshd. An October 2026 OpenSSH security review fixed the picksalt() function; the actual bug lived four lines below. The discoverer found it by systematically building sshd against every combination of libc and PAM configuration and throwing 17,600 malformed logins at each build. Every configuration agreed on every result except musl-without-PAM, which accepted passwords it shouldn't have. The fix shipped in OpenSSH 10.6p2. For systems that can't update immediately, disabling password authentication entirely (PasswordAuthentication no) eliminates the attack surface. What makes this story structurally important isn't the bug itself but what it reveals about how security assumptions compose. Each decision was locally reasonable: Joy's '' convention, musl's crash-prevention return value, the SHA-512 length cap, OpenSSH's timing-attack mitigation. The vulnerability exists only in the interaction of all four, across three different codebases maintained by three different groups, none of whom tested the full composition. The Unix security model has been running on convention for 46 years; this is what happens when a convention collides with an implementation detail nobody thought to check.
