I've posted this over at ServerFault but haven't received a response over there. I'm not a security professional, but I'm curious as to what kind of attack this might be and how the attackers might be performing it. I figured someone here who's more knowledgeable in security might know.
Here's the text of the original post:
I'm seeing strange entries for sshd in my audit logs along the lines of:
type=SECCOMP audit(1433519794.902:46): auid=20003 uid=22 gid=22 ses=21 pid=25136 comm="sshd" exe="/usr /sbin/sshd" sig=31 arch=40000003 syscall=102 compat=0 ip=0xb76c8aac code=0x0
type=SECCOMP msg=audit(1433785727.186:10262): auid=20003 uid=22 gid=22 ses=21 pid=11217 comm="sshd" exe="/usr/sbin/sshd" sig=31 arch=400 00003 syscall=132 compat=0 ip=0xb7670aac code=0x0
Anyone have any idea what's happening? My guess is that, OpenSSH forks a sandboxed process for preauth and someone is attempting to execute system calls (socketcall and getpgid) during this connection phase.
All connections appear to come from Korea.
I should add that I'm using OpenSSH 6.7p1 and Linux kernel version 3.18.12.