Project

General

Profile

Actions

Bug #6247

closed

pcre: parsing crash in multi-tenant multi-loader setup

Added by Victor Julien 9 months ago. Updated 9 months ago.

Status:
Closed
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Same issue as #4797, fix was incomplete.

Thread 3 "DL#02" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff560d640 (LWP 1009871)]
__memmove_evex_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:416
416    ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory.
(gdb) bt
#0  __memmove_evex_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:416
#1  0x00007ffff7dc5f2b in pcre2_substring_copy_bynumber_8 () from /lib/x86_64-linux-gnu/libpcre2-8.so.0
#2  0x0000555555cb04aa in DetectPcreParse (de_ctx=0x7fffe8000bc0, regexstr=0x7ffff55f9bd7 "/UPDATE.+SET/Ui", sm_list=0x7ffff55f9550, capture_names=0x7ffff55f9580 "", capture_names_size=1024, negate=false, alproto=0x7ffff55f954e) at detect-pcre.c:413
#3  0x0000555555cb212d in DetectPcreSetup (de_ctx=0x7fffe8000bc0, s=0x7fffe961cc80, regexstr=0x7ffff55f9bd7 "/UPDATE.+SET/Ui") at detect-pcre.c:857
#4  0x0000555555ca8bcf in SigParseOptions (de_ctx=0x7fffe8000bc0, s=0x7fffe961cc80, optstr=0x7ffff55f9bd1 "pcre", output=0x7ffff55f9a40 "", output_size=393) at detect-parse.c:987
#5  0x0000555555caa23a in SigParse (de_ctx=0x7fffe8000bc0, s=0x7fffe961cc80, 
    sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"..., addrs_direction=0 '\000', 
    parser=0x7ffff55f9e80) at detect-parse.c:1444
#6  0x0000555555cad6cf in SigInitHelper (de_ctx=0x7fffe8000bc0, 
    sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"..., dir=0 '\000') at detect-parse.c:2116
#7  0x0000555555cade41 in SigInit (de_ctx=0x7fffe8000bc0, 
    sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"...) at detect-parse.c:2273
#8  0x0000555555cae7a6 in DetectEngineAppendSig (de_ctx=0x7fffe8000bc0, 
    sigstr=0x7ffff5609f70 "alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:\"ET WEB_SPECIFIC_APPS Jetbox CMS SQL Injection Attempt -- outputs.php UPDATE\"; flow:established,to_server; content:\"/outputs.php?\"; nocas"...) at detect-parse.c:2571
#9  0x0000555555c4ad00 in DetectLoadSigFile (de_ctx=0x7fffe8000bc0, sig_file=0x7fffe8075a00 "/home/victor/devel/eidps/multi-tenant/etpro-all.rules", goodsigs=0x7ffff560c064, badsigs=0x7ffff560c068) at detect-engine-loader.c:177
#10 0x0000555555c4b242 in ProcessSigFiles (de_ctx=0x7fffe8000bc0, pattern=0x7fffe8075980 "/home/victor/devel/eidps/multi-tenant/etpro-all.rules", st=0x7fffe8002000, good_sigs=0x7ffff560c064, bad_sigs=0x7ffff560c068) at detect-engine-loader.c:261
#11 0x0000555555c4b5c6 in SigLoadSignatures (de_ctx=0x7fffe8000bc0, sig_file=0x0, sig_file_exclusive=0) at detect-engine-loader.c:320
#12 0x0000555555c3dd69 in DetectEngineMultiTenantLoadTenant (tenant_id=8, filename=0x555557537170 "/home/victor/devel/eidps/multi-tenant/tenant-etpro.yaml", loader_id=1) at detect-engine.c:3855
#13 0x0000555555c3e197 in DetectLoaderFuncLoadTenant (vctx=0x5555584c7c60, loader_id=1) at detect-engine.c:3936
#14 0x0000555555c4c3e8 in DetectLoader (th_v=0x5555584b2880, thread_data=0x7fffe8000b70) at detect-engine-loader.c:602
#15 0x0000555555b79897 in TmThreadsManagement (td=0x5555584b2880) at tm-threads.c:555
#16 0x00007ffff7077b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#17 0x00007ffff7109a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Related issues 1 (0 open1 closed)

Related to Suricata - Bug #4797: pcre2 crash in multi-tenantClosedJeff LucovskyActions
Actions #1

Updated by Victor Julien 9 months ago

  • Related to Bug #4797: pcre2 crash in multi-tenant added
Actions #2

Updated by Victor Julien 9 months ago

  • Status changed from Assigned to In Progress
Actions #3

Updated by Victor Julien 9 months ago

  • Status changed from In Progress to In Review
Actions #4

Updated by Victor Julien 9 months ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF