Posted by Vidya Murthy on Nov 09 Adding a data point from the medical-device side: we reproduced this independently at Medcrypt, including on a stock Yocto image, no unusual configuration, which is the concerning part given how common musl + no-PAM + password-auth-on + *-locked service accounts is as a “hardened” embedded baseline. Wrote up the mechanism (the pick_salt() cache and explicit_bzero() interaction is worth a careful read if you haven’t dug into the two-attempt...

Read the full article at oss-security →