Bug #4514

Updated by Victor Julien 6 months ago

 Jun    5 10:08:54 romwe-03 kernel: W#01-ens6[10072]: segfault at ffffffff00000018 ip 00000000005256e5 sp 00007f3ab7c33550 error 5 in suricata[400000+5a5000] 
 Jun    5 10:08:54 romwe-03 audispd: node=shein-10 type=ANOM_ABEND msg=audit(1622858934.975:290714): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10044 comm="W#01-ens6" reason="memory violation" sig=11 

 [root@romwe-03 log]# suricata --build-info 
 This is Suricata version 6.0.2 RELEASE 
 SIMD support: SSE_4_2 SSE_4_1 SSE_3  
 Atomic intrinsics: 1 2 4 8 16 byte(s) 
 64-bits, Little-endian architecture 
 GCC version 4.8.5 20150623 (Red Hat 4.8.5-44), C version 199901 
 compiled with _FORTIFY_SOURCE=0 
 L1 cache line size (CLS)=64 
 thread local storage method: __thread 
 compiled with LibHTP v0.5.37, linked against LibHTP v0.5.37 

 Suricata Configuration: 
   AF_PACKET support:                         yes 
   eBPF support:                              no 
   XDP support:                               no 
   PF_RING support:                           yes 
   NFQueue support:                           no 
   NFLOG support:                             no 
   IPFW support:                              no 
   Netmap support:                            no  
   DAG enabled:                               no 
   Napatech enabled:                          no 
   WinDivert enabled:                         no 

   Unix socket enabled:                       yes 
   Detection enabled:                         yes 

   Libmagic support:                          yes 
   libnss support:                            yes 
   libnspr support:                           yes 
   libjansson support:                        yes 
   hiredis support:                           no 
   hiredis async with libevent:               no 
   Prelude support:                           no 
   PCRE jit:                                  yes 
   LUA support:                               yes, through luajit 
   libluajit:                                 yes 
   GeoIP2 support:                            yes 
   Non-bundled htp:                           no 
   Hyperscan support:                         yes 
   Libnet support:                            yes 
   liblz4 support:                            yes 

   Rust support:                              yes 
   Rust strict mode:                          no 
   Rust compiler path:                        /bin/rustc 
   Rust compiler version:                     rustc 1.49.0 
   Cargo path:                                /bin/cargo 
   Cargo version:                             cargo 1.49.0 
   Cargo vendor:                              yes 

   Python support:                            yes 
   Python path:                               /bin/python3 
   Python distutils                           yes 
   Python yaml                                no 
   Install suricatactl:                       yes 
   Install suricatasc:                        yes 
   Install suricata-update:                   no, requires pyyaml 

   Profiling enabled:                         no 
   Profiling locks enabled:                   no 

   Plugin support (experimental):             yes 

 Development settings: 
   Coccinelle / spatch:                       no 
   Unit tests enabled:                        no 
   Debug output enabled:                      no 
   Debug validation enabled:                  no 

 Generic build parameters: 
   Installation prefix:                       /usr 
   Configuration directory:                   /etc/suricata/ 
   Log directory:                             /var/log/suricata/ 

   --prefix                                   /usr 
   --sysconfdir                               /etc 
   --localstatedir                            /var 
   --datarootdir                              /usr/share 

   Host:                                      x86_64-pc-linux-gnu 
   Compiler:                                  gcc (exec name) / g++ (real) 
   GCC Protect enabled:                       no 
   GCC march native enabled:                  yes 
   GCC Profile enabled:                       no 
   Position Independent Executable enabled: no 
   CFLAGS                                     -g -O2 -std=gnu99 -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist 

 gdb suricata core.10044 
 GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.el7 
 Copyright (C) 2013 Free Software Foundation, Inc. 
 License GPLv3+: GNU GPL version 3 or later <> 
 This is free software: you are free to change and redistribute it. 
 There is NO WARRANTY, to the extent permitted by law.    Type "show copying" 
 and "show warranty" for details. 
 This GDB was configured as "x86_64-redhat-linux-gnu". 
 For bug reporting instructions, please see: 
 Reading symbols from /usr/bin/suricata...done. 

 warning: core file may not match specified executable file. 
 [New LWP 10072] 
 [New LWP 10085] 
 [New LWP 10083] 
 [New LWP 10076] 
 [New LWP 10090] 
 [New LWP 10091] 
 [New LWP 10081] 
 [New LWP 10086] 
 [New LWP 10093] 
 [New LWP 10095] 
 [New LWP 10087] 
 [New LWP 10088] 
 [New LWP 10073] 
 [New LWP 10082] 
 [New LWP 10044] 
 [New LWP 10098] 
 [New LWP 10099] 
 [New LWP 10100] 
 [New LWP 10096] 
 [New LWP 10097] 
 [New LWP 10092] 
 [Thread debugging using libthread_db enabled] 
 Using host libthread_db library "/lib64/". 
 Core was generated by `suricata -vvv --pfring -k none -c /etc/suricata/suricata.yaml'. 
 Program terminated with signal 11, Segmentation fault. 
 #0    0x00000000005256e5 in ThresholdHandlePacket (p=p@entry=0x7f3a91cdbb50, lookup_tsh=0xffffffff00000000, new_tsh=new_tsh@entry=0x7f3ab7c335a8,  
     td=td@entry=0x1c572cf0, sid=3000002, gid=1, pa=pa@entry=0x7f3a91cdbd08) at detect-engine-threshold.c:415 
 415 	                 if (TIMEVAL_DIFF_SEC(p->ts, lookup_tsh->tv1) < td->seconds) { 
 Missing separate debuginfos, use: debuginfo-install file-libs-5.11-37.el7.x86_64 glibc-2.17-260.el7.x86_64 jansson-2.10-1.el7.x86_64 libcap-ng-0.7.5-4.el7.x86_64 libgcc-4.8.5-44.el7.x86_64 libmaxminddb-1.2.0-6.el7.x86_64 libnet-1.1.6-7.el7.x86_64 libpcap-1.5.3-12.el7.x86_64 libstdc++-4.8.5-44.el7.x86_64 libyaml-0.1.4-11.el7_0.x86_64 lz4-1.8.3-1.el7.x86_64 nspr-4.25.0-2.el7_9.x86_64 nss-3.53.1-3.el7_9.x86_64 nss-softokn-3.53.1-6.el7_9.x86_64 nss-softokn-freebl-3.53.1-6.el7_9.x86_64 nss-util-3.53.1-1.el7_9.x86_64 pcre-8.32-17.el7.x86_64 sqlite-3.7.17-8.el7.x86_64 zlib-1.2.7-19.el7_9.x86_64 

 (gdb) bt 
 #0    0x00000000005256e5 in ThresholdHandlePacket (p=p@entry=0x7f3a91cdbb50, lookup_tsh=0xffffffff00000000, new_tsh=new_tsh@entry=0x7f3ab7c335a8,  
     td=td@entry=0x1c572cf0, sid=3000002, gid=1, pa=pa@entry=0x7f3a91cdbd08) at detect-engine-threshold.c:415 
 #1    0x0000000000525efc in ThresholdHandlePacketRule (de_ctx=0x178ea3c0, s=0x1c56e060, s=0x1c56e060, s=0x1c56e060, pa=0x7f3a91cdbd08, td=0x1c572cf0, p=0x7f3a91cdbb50) 
     at detect-engine-threshold.c:584 
 #2    PacketAlertThreshold (de_ctx=de_ctx@entry=0x178ea3c0, det_ctx=det_ctx@entry=0x7f3a91de0360, td=0x1c572cf0, p=p@entry=0x7f3a91cdbb50, s=s@entry=0x1c56e060,  
     pa=pa@entry=0x7f3a91cdbd08) at detect-engine-threshold.c:639 
 #3    0x0000000000510f31 in PacketAlertHandle (pa=0x7f3a91cdbd08, p=0x7f3a91cdbb50, s=0x1c56e060, det_ctx=0x7f3a91de0360, de_ctx=0x178ea3c0) 
     at detect-engine-alert.c:116 
 #4    PacketAlertFinalize (de_ctx=de_ctx@entry=0x178ea3c0, det_ctx=det_ctx@entry=0x7f3a91de0360, p=p@entry=0x7f3a91cdbb50) at detect-engine-alert.c:247 
 #5    0x00000000004fd4f9 in DetectRunPostRules (scratch=<optimized out>, scratch=<optimized out>, pflow=<optimized out>, p=<optimized out>, det_ctx=<optimized out>,  
     de_ctx=<optimized out>, tv=<optimized out>) at detect.c:939 
 #6    DetectRun (th_v=th_v@entry=0x1beb0dd0, de_ctx=<optimized out>, det_ctx=0x7f3a91de0360, p=p@entry=0x7f3a91cdbb50) at detect.c:141 
 #7    0x00000000004fde7b in DetectRun (p=0x7f3a91cdbb50, det_ctx=<optimized out>, de_ctx=<optimized out>, th_v=0x1beb0dd0) at detect.c:1607 
 #8    DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1614 
 #9    Detect (tv=tv@entry=0x1beb0dd0, p=p@entry=0x7f3a91cdbb50, data=data@entry=0x7f3a91de0360) at detect.c:1674 
 #10 0x000000000055df0b in FlowWorker (tv=0x1beb0dd0, p=0x7f3a91cdbb50, data=0x7f3a91cf70d0) at flow-worker.c:540 
 #11 0x00000000005adcae in TmThreadsSlotVarRun (tv=tv@entry=0x1beb0dd0, p=p@entry=0x7f3a91cdbb50, slot=<optimized out>) at tm-threads.c:117 
 #12 0x00000000005adce4 in TmThreadsSlotVarRun (tv=tv@entry=0x1beb0dd0, p=p@entry=0x7f3a91ce3080, slot=<optimized out>) at tm-threads.c:135 
 #13 0x00000000005990ac in TmThreadsSlotProcessPkt (p=0x7f3a91ce3080, s=<optimized out>, tv=0x1beb0dd0) at tm-threads.h:192 
 #14 ReceivePfringLoop (tv=0x1beb0dd0, data=0x7f3aabffdd90, slot=<optimized out>) at source-pfring.c:415 
 #15 0x00000000005af3d1 in TmThreadsSlotPktAcqLoop (td=0x1beb0dd0) at tm-threads.c:312 
 #16 0x00007f3abe544dd5 in start_thread () from /lib64/ 
 #17 0x00007f3abde53ead in clone () from /lib64/