Changes between Initial Version and Version 1 of ipp030.crash.20140625

Timestamp:

Jun 25, 2014, 2:53:44 AM (12 years ago)

Author:

Mark Huber

Comment:

--

ipp030.crash.20140625

@@ +1 @@
+from console
+
+{{{
+<Jun/25 02:24 am>ipp030 login: [76149.575584] kernel tried to execute NX-protected page - exploit attempt? (uid: 520)
+
+<Jun/25 02:24 am>[76149.583273] BUG: unable to handle kernel paging request at ffff880444f7bf50
+<Jun/25 02:24 am>[76149.585549] IP: [<ffff880444f7bf50>] 0xffff880444f7bf4f
+<Jun/25 02:24 am>[76149.585549] PGD 16bc063 PUD bff47067 PMD 8000000444e001e3 
+<Jun/25 02:24 am>[76149.585549] Oops: 0011 [#1] SMP 
+<Jun/25 02:24 am>[76149.585549] Modules linked in: w83627hf w83793 hwmon_vid k8temp ipv6 dm_mod snd_hda_codec_realtek acpi_cpufreq ehci_hcd uhci_hcd usbcore snd_hda_intel snd_hda_codec i2c_i801 snd_hwdep snd_pcm snd_timer e1000e(O) sg floppy mperf processor microcode i2c_core coretemp snd snd_page_alloc pcspkr thermal_sys i5k_amb container usb_common button
+
+<Jun/25 02:24 am>[76149.585549] CPU 2 
+<Jun/25 02:24 am>[76149.585549] Pid: 28131, comm: sshd Tainted: G          IO 3.7.6 #1 Empty Empty/S5397
+<Jun/25 02:24 am>[76149.585549] RIP: 0010:[<ffff880444f7bf50>]  [<ffff880444f7bf50>] 0xffff880444f7bf4f
+<Jun/25 02:24 am>[76149.585549] RSP: 0018:ffff880444f7bdc8  EFLAGS: 00010017
+<Jun/25 02:24 am>[76149.585549] RAX: 0000000081517695 RBX: 0000000000000001 RCX: ffffffff81517695
+<Jun/25 02:24 am>[76149.585549] RDX: 650000000bbf0000 RSI: ffff880444f7bf50 RDI: ffffffff8102d64e
+<Jun/25 02:24 am>[76149.585549] RBP: ffff880444f7bf28 R08: 0000000000000000 R09:<Jun/25 02:24 am>
+                 <Jun/25 02:24 am>[76149.585549] R10: 0000000000000008 R11: 0000000000000246 R12: 00007f014bfe6698
+<Jun/25 02:24 am>[76149.585549] R13: 00007fff398820b0 R14: ffff880444f7bf50 R15: 00007fff398861f8
+<Jun/25 02:24 am>[76149.585549] FS:  00007f014bfe66f0(0000) GS:ffff88063fc80000(0000) knlGS:0000000000000000
+<Jun/25 02:24 am>[76149.585549] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+<Jun/25 02:24 am>[76149.585549] CR2: ffff880444f7bf50 CR3: 0000000582bb4000 CR4: 00000000000007e0
+<Jun/25 02:24 am>[76149.585549] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+<Jun/25 02:24 am>[76149.585549] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+<Jun/25 02:24 am>[76149.585549] Process sshd (pid: 28131, threadinfo ffff880444f7a000, task ffff8806272b72b0)
+<Jun/25 02:24 am>[76149.585549] Stack:
+<Jun/25 02:24 am>[76149.585549]  00007fff398861f8 0000000000000000 00007fff398820b0 00007f014bfe6698
+<Jun/25 02:24 am>[76149.585549]  ffff880444f7bf28 0000000000000001 0000000000000246 0000000000000008
+<Jun/25 02:24 am>[76149.585549]  0000000000000001 0000000000000000 0000000081517695 ffffffff81517695
+<Jun/25 02:24 am>[76149.585549] Call Trace:
+<Jun/25 02:24 am>[76149.585549]  [<ffffffff81517695>] ? restore_args+0x30/0x30
+<Jun/25 02:24 am>[76149.585549]  [<ffffffff8102d64e>] ? default_handler+0x50/0x6c
+
+<Jun/25 02:24 am>[76149.585549]  [<ffffffff8102d64e>] ? default_handler+0x50/0x6c
+<Jun/25 02:24 am>[76149.585549]  [<ffffffff810d4b24>] ? fget_light+0x5c/0x94
+<Jun/25 02:24 am>[76149.585549]  [<ffffffff810bfb41>] sys_read+0x22/0x79
+<Jun/25 02:24 am>[76149.585549]  [<ffffffff81517d52>] system_call_fastpath+0x16/0x1b
+<Jun/25 02:24 am>[76149.585549] Code: 88 ff ff 78 bf f7 44 04 88 ff ff 41 fb 0b 81 ff ff ff ff 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 01 00 00 00 00 00 <00> 00 00 00 ff 7f 00 00 10 91 67 00 00 00 00 00 98 66 fe 4b 01 
+<Jun/25 02:24 am>[76149.585549] RIP  [<ffff880444f7bf50>] 0xffff880444f7bf4f
+<Jun/25 02:24 am>[76149.585549]  RSP <ffff880444f7bdc8>
+<Jun/25 02:24 am>[76149.585549] CR2: ffff880444f7bf50
+<Jun/25 02:24 am>[76149.585549] ---[ end trace 6caf08d7a989069d ]---
+
+
+}}}