To the extent that systems that are configured in the vulnerable manner exist in the wild, I’m surprised they weren’t exploited years ago by trivial ssh bots.

P.S. Wow, I’m reminded of just how awful traditional UNIX-y C APIs and code are.

P.P.S. The musl code in question is nuts. The API it implements is awful. Seriously, here’s the manpage:

https://man.archlinux.org/man/crypt.3.en

You basically can’t use it correctly. sshd’s “fix” is basically to assume that a too-short return is an error return instead of a success return.

PAM is also awful, but this is worse.

> This release contains a critical security workaround that affects Linux systems that use the musl libc and PAM disabled.

But that there's nothing about it on their security page.

Even if it's not technically a bug in their code, the fact that they've made a "critical" release to address it suggests that it should probably be listed on the security page as well. But maybe (hopefully) they just haven't updated the security page yet.

     PasswordAuthentication=no