Actions
Bug #3925
closeddcerpc: crash in eve logging
Affected Versions:
Effort:
Difficulty:
Label:
Description
Affected 6.0-rc1
Chasing it to get a usable core but this is what i have so far.
-- 20:56:02 - <Perf> - AF_PACKET V3 RX Ring params: block_size=1048576 block_nr=318 frame_size=1664 frame_nr=200340 (mem: 333447168)
-- 20:56:02 - <Perf> - AF_PACKET V3 RX Ring params: block_size=1048576 block_nr=318 frame_size=1664 frame_nr=200340 (mem: 333447168)
-- 20:56:02 - <Info> - All AFP capture threads are running.
-- 03:13:46 - <Notice> - Flow emergency mode entered...
-- 03:13:46 - <Notice> - Flow emergency mode entered...
-- 03:13:46 - <Notice> - Flow emergency mode entered...
-- 03:13:46 - <Notice> - Flow emergency mode entered...
-- 03:13:46 - <Notice> - Flow emergency mode entered...
-- 03:13:46 - <Notice> - Flow emergency mode entered...
-- 03:13:46 - <Notice> - Flow emergency mode entered...
-- 03:13:46 - <Notice> - Flow emergency mode entered...
AddressSanitizer:DEADLYSIGNAL
=================================================================
==37045==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x000000e0b343 bp 0x7f1856ff11f8 sp 0x7f1856ff0fe0 T2)
==37045==The signal is caused by a READ memory access.
==37045==Hint: address points to the zero page.
#0 0xe0b342 in suricata::dcerpc::log::log_dcerpc_header::h26d5fd104f0ee8ce /opt/suricata/rust/src/dcerpc/log.rs:39:43
#1 0xe0d809 in rs_dcerpc_log_json_record /opt/suricata/rust/src/dcerpc/log.rs:86:5
#2 0xa4e5c2 in JsonDCERPCLogger /opt/suricata/src/output-json-dcerpc.c:55:10
#3 0xa5f283 in OutputTxLog /opt/suricata/src/output-tx.c:298:17
#4 0x9dabcf in OutputLoggerLog /opt/suricata/src/output.c:882:9
#5 0x984b80 in FlowWorker /opt/suricata/src/flow-worker.c:545:5
#6 0xb8e24e in TmThreadsSlotVarRun /opt/suricata/src/tm-threads.c:117:21
#7 0xaaf1b2 in TmThreadsSlotProcessPkt /opt/suricata/src/./tm-threads.h:192:17
#8 0xaa80a0 in AFPParsePacketV3 /opt/suricata/src/source-af-packet.c:1113:9
#9 0xaa6717 in AFPWalkBlock /opt/suricata/src/source-af-packet.c:1128:15
#10 0xa9e040 in AFPReadFromRingV3 /opt/suricata/src/source-af-packet.c:1178:15
#11 0xa9bc17 in ReceiveAFPLoop /opt/suricata/src/source-af-packet.c:1571:17
#12 0xb9baaf in TmThreadsSlotPktAcqLoop /opt/suricata/src/tm-threads.c:312:13
#13 0x7f18679ecfa2 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7fa2)
#14 0x7f18669404ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /opt/suricata/rust/src/dcerpc/log.rs:39:43 in suricata::dcerpc::log::log_dcerpc_header::h26d5fd104f0ee8ce
Thread T2 (W#02-ens1np0) created by T0 (Suricata-Main) here:
#0 0x564dfd in pthread_create (/usr/local/bin/suricata+0x564dfd)
#1 0xb95b74 in TmThreadSpawn /opt/suricata/src/tm-threads.c:1721:14
#2 0xcb4079 in RunModeSetLiveCaptureWorkersForDevice /opt/suricata/src/util-runmodes.c:323:13
#3 0xcb383c in RunModeSetLiveCaptureWorkers /opt/suricata/src/util-runmodes.c:353:9
#4 0xa7c2e2 in RunModeIdsAFPWorkers /opt/suricata/src/runmode-af-packet.c:903:11
#5 0xa93369 in RunModeDispatch /opt/suricata/src/runmodes.c:391:5
#6 0xb76d91 in SuricataMain /opt/suricata/src/suricata.c:2800:5
#7 0x5ab6be in main /opt/suricata/src/main.c:22:12
#8 0x7f186686b09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
==37045==ABORTING
/usr/local/bin/suricata --build-info
This is Suricata version 6.0.0-rc1 RELEASE
Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrinsics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 4.2.1 Compatible Clang 7.0.1 (tags/RELEASE_701/final), C version 201112
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: _Thread_local
compiled with LibHTP v0.5.34, linked against LibHTP v0.5.34
Suricata Configuration:
AF_PACKET support: yes
eBPF support: yes
XDP support: yes
PF_RING support: no
NFQueue support: no
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no
WinDivert enabled: no
Unix socket enabled: yes
Detection enabled: yes
Libmagic support: yes
libnss support: yes
libnspr support: yes
libjansson support: yes
hiredis support: no
hiredis async with libevent: no
Prelude support: no
PCRE jit: yes
LUA support: yes, through luajit
libluajit: yes
GeoIP2 support: yes
Non-bundled htp: no
Old barnyard2 support:
Hyperscan support: yes
Libnet support: yes
liblz4 support: yes
Rust support: yes
Rust strict mode: yes
Rust compiler path: /root/.cargo/bin/rustc
Rust compiler version: rustc 1.46.0 (04488afe3 2020-08-24)
Cargo path: /root/.cargo/bin/cargo
Cargo version: cargo 1.46.0 (149022b1d 2020-07-17)
Cargo vendor: yes
Python support: yes
Python path: /usr/bin/python3
Python distutils yes
Python yaml yes
Install suricatactl: yes
Install suricatasc: yes
Install suricata-update: not bundled
Profiling enabled: no
Profiling locks enabled: no
Plugin support (experimental): yes
Development settings:
Coccinelle / spatch: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no
Generic build parameters:
Installation prefix: /usr/local
Configuration directory: /usr/local/etc/suricata/
Log directory: /usr/local/var/log/suricata/
--prefix /usr/local
--sysconfdir /usr/local/etc
--localstatedir /usr/local/var
--datarootdir /usr/local/share
Host: x86_64-pc-linux-gnu
Compiler: clang (exec name) / g++ (real)
GCC Protect enabled: no
GCC march native enabled: yes
GCC Profile enabled: no
Position Independent Executable enabled: no
CFLAGS -ggdb3 -O0 -Werror -Wchar-subscripts -Wshadow -Wall -Wextra -Werror -Wno-unused-parameter -Wno-unused-function -fno-strict-aliasing -fstack-protector-all -fsanitize=address -fno-omit-frame-pointer -Wno-unused-parameter -Wno-unused-function -std=c11 -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist
PCAP_CFLAGS -I/usr/include
SECCFLAGS
Files
Updated by Victor Julien over 4 years ago
- Status changed from New to Assigned
- Assignee set to Shivani Bhardwaj
- Target version set to 6.0.0
- Affected Versions 6.0.0rc1 added
Updated by Victor Julien over 4 years ago
The SEGV seems to be a null pointer deref, but in a strange location
fn log_dcerpc_header(
jsb: &mut JsonBuilder, state: &DCERPCState, tx: &DCERPCTransaction,
) -> Result<(), JsonError> {
if tx.req_done == true && tx.req_lost == false {
jsb.set_string("request", &dcerpc_type_string(tx.req_cmd))?;
match tx.req_cmd {
DCERPC_TYPE_REQUEST => {
jsb.open_object("req")?;
jsb.set_uint("opnum", tx.opnum as u64)?;
jsb.set_uint("frag_cnt", tx.frag_cnt_ts as u64)?;
jsb.set_uint("stub_data_size", tx.stub_data_buffer_len_ts as u64)?;
jsb.close()?;
}
DCERPC_TYPE_BIND => match &state.bind {
Some(bind) => {
jsb.open_array("interfaces")?;
for uuid in &bind.uuid_list {
jsb.start_object()?; <- line 39
It's almost like
jsb is null, but there have been operations on it before and it seems like all paths leading to this check if we have a non-null JsonBuilder object.Updated by Victor Julien about 4 years ago
- Target version changed from 6.0.0 to 6.0.1
Updated by Victor Julien about 4 years ago
- Assignee changed from Shivani Bhardwaj to Victor Julien
- Priority changed from Normal to High
Updated by Victor Julien about 4 years ago
- Subject changed from SEGV dcerpc to dcerpc: crash in eve logging
- Affected Versions 6.0.0 added
Updated by Victor Julien about 4 years ago
- Related to Bug #4069: dcerpc: fix UDP transaction handling, free_tx, etc added
Updated by Victor Julien about 4 years ago
- Status changed from Assigned to Closed
- Priority changed from High to Normal
Actions