Linux SSHD: Flag failed curve25519 key generation suggesting libssh authentication bypass attempts

Alerts on sshd log entries with 'Failed to generate curve25519 keys' that may indicate CVE-2023-2283 libssh bypass attempts.

FreeUnreviewedSigmamediumv1

linux-sshd-flag-failed-curve25519-key-generation-suggesting-libssh-authenticatio-8b244735

title: "Linux SSHD: Flag failed curve25519 key generation suggesting libssh authentication bypass attempts"
id: f6f25051-59e3-4b0e-95f8-4ed928dec009
status: test
description: This rule flags SSH daemon events containing the error text 'Failed to generate curve25519 keys'. The behavior is used to signal a likely attempt to exploit a libssh authentication bypass associated with CVE-2023-2283, where the exploit path can trigger key-generation errors. It relies on Linux sshd log messages that include this specific keyword phrase; it does not indicate successful exploitation, only the presence of the failure signature.
references:
  - https://twitter.com/kevin_backhouse/status/1666459308941357056?s=20
  - https://git.libssh.org/projects/libssh.git/tree/src/curve25519.c#n420
  - https://nvd.nist.gov/vuln/detail/CVE-2023-2283
  - https://www.blumira.com/cve-2023-2283/
  - https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-2283/lnx_sshd_exploit_cve_2023_2283_libssh_authentication_bypass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-06-09
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-2283
  - detection.emerging-threats
logsource:
  product: linux
  service: sshd
detection:
  keywords:
    - Failed to generate curve25519 keys
  condition: keywords
falsepositives:
  - Errors with the initialization or generation of the X25519 elliptic curve keys may generate the same error message
level: medium
license: DRL-1.1
related:
  - id: 8b244735-5833-4517-a45b-28d8c63924c0
    type: derived

What it detects

This rule flags SSH daemon events containing the error text 'Failed to generate curve25519 keys'. The behavior is used to signal a likely attempt to exploit a libssh authentication bypass associated with CVE-2023-2283, where the exploit path can trigger key-generation errors. It relies on Linux sshd log messages that include this specific keyword phrase; it does not indicate successful exploitation, only the presence of the failure signature.

Known false positives

Errors with the initialization or generation of the X25519 elliptic curve keys may generate the same error message

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.