Actions
Bug #6247
closedpcre: parsing crash in multi-tenant multi-loader setup
Affected Versions:
Effort:
Difficulty:
Label:
Description
Same issue as #4797, fix was incomplete.
Thread 3 "DL#02" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff560d640 (LWP 1009871)] __memmove_evex_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:416 416 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory. (gdb) bt #0 __memmove_evex_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:416 #1 0x00007ffff7dc5f2b in pcre2_substring_copy_bynumber_8 () from /lib/x86_64-linux-gnu/libpcre2-8.so.0 #2 0x0000555555cb04aa in DetectPcreParse (de_ctx=0x7fffe8000bc0, regexstr=0x7ffff55f9bd7 "/UPDATE.+SET/Ui", sm_list=0x7ffff55f9550, capture_names=0x7ffff55f9580 "", capture_names_size=1024, negate=false, alproto=0x7ffff55f954e) at detect-pcre.c:413 #3 0x0000555555cb212d in DetectPcreSetup (de_ctx=0x7fffe8000bc0, s=0x7fffe961cc80, regexstr=0x7ffff55f9bd7 "/UPDATE.+SET/Ui") at detect-pcre.c:857 #4 0x0000555555ca8bcf in SigParseOptions (de_ctx=0x7fffe8000bc0, s=0x7fffe961cc80, optstr=0x7ffff55f9bd1 "pcre", output=0x7ffff55f9a40 "", output_size=393) at detect-parse.c:987 #5 0x0000555555caa23a in SigParse (de_ctx=0x7fffe8000bc0, s=0x7fffe961cc80, sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"..., addrs_direction=0 '\000', parser=0x7ffff55f9e80) at detect-parse.c:1444 #6 0x0000555555cad6cf in SigInitHelper (de_ctx=0x7fffe8000bc0, sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"..., dir=0 '\000') at detect-parse.c:2116 #7 0x0000555555cade41 in SigInit (de_ctx=0x7fffe8000bc0, sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"...) at detect-parse.c:2273 #8 0x0000555555cae7a6 in DetectEngineAppendSig (de_ctx=0x7fffe8000bc0, sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"...) at detect-parse.c:2571 #9 0x0000555555c4ad00 in DetectLoadSigFile (de_ctx=0x7fffe8000bc0, sig_file=0x7fffe8075a00 "/home/victor/devel/eidps/multi-tenant/etpro-all.rules", goodsigs=0x7ffff560c064, badsigs=0x7ffff560c068) at detect-engine-loader.c:177 #10 0x0000555555c4b242 in ProcessSigFiles (de_ctx=0x7fffe8000bc0, pattern=0x7fffe8075980 "/home/victor/devel/eidps/multi-tenant/etpro-all.rules", st=0x7fffe8002000, good_sigs=0x7ffff560c064, bad_sigs=0x7ffff560c068) at detect-engine-loader.c:261 #11 0x0000555555c4b5c6 in SigLoadSignatures (de_ctx=0x7fffe8000bc0, sig_file=0x0, sig_file_exclusive=0) at detect-engine-loader.c:320 #12 0x0000555555c3dd69 in DetectEngineMultiTenantLoadTenant (tenant_id=8, filename=0x555557537170 "/home/victor/devel/eidps/multi-tenant/tenant-etpro.yaml", loader_id=1) at detect-engine.c:3855 #13 0x0000555555c3e197 in DetectLoaderFuncLoadTenant (vctx=0x5555584c7c60, loader_id=1) at detect-engine.c:3936 #14 0x0000555555c4c3e8 in DetectLoader (th_v=0x5555584b2880, thread_data=0x7fffe8000b70) at detect-engine-loader.c:602 #15 0x0000555555b79897 in TmThreadsManagement (td=0x5555584b2880) at tm-threads.c:555 #16 0x00007ffff7077b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #17 0x00007ffff7109a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
Updated by Victor Julien over 1 year ago
- Related to Bug #4797: pcre2 crash in multi-tenant added
Updated by Victor Julien over 1 year ago
- Status changed from Assigned to In Progress
Updated by Victor Julien over 1 year ago
- Status changed from In Progress to In Review
Updated by Victor Julien over 1 year ago
- Status changed from In Review to Closed
Actions