Re: RFC: how to document musl-crypt failure ?

[Alejandro Colomar <alx+linux-man@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1178 bytes --]

Hi Walter,

> Date: 2026-11-09 08:59:19+0000
> From: Walter Harms <wharms@bfs.de>
>
> Hello list,
> in case someone missed it: musl crypt() had an documented but
> unexpected behavier that caused a lot of trouble.  See:
> <https://news.ycombinator.com/item?id=50377221>   SSHHole.com  CVE-2026-123158

Indeed, I also wondered if we should change something in the
documentation after it happened.  Unfortunately, the bug has been
treated with some secrecy in the first days (reasonable), so I couldn't
really understand what went wrong.

I've CCed Rich and also musl and glibc, since they probably want to
comment.  I've also CCd shadow-utils.

> Normaly i would step over it but in this special case ... it would
> like to start a discussion if we should mention that in a note to
> crypt().

Thanks!

> Perhaps recommending an additional check for '*' ?  I am not sure but
> this is a very special case ...

Rich, now that some time has passed and I guess everyone has a patched
SSH, would you mind clarifying what happened, and what should be
documented about it?


Have a lovely day!
Alex

> CU 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]