Public bug reported:
Hi,
This morning I had an issue in the install of elasticsearch-2.4.6, and
when I have a look in journalctl, I have this BUG: unable to handle
kernel paging request at 00007f7d7d67e7a0
My configuration:
elasticsearch@es-usb:~$ uname -r
4.13.0-1006-azure
When I do the downgrade on the 4.11.0-1016-azure kernel version,
everything is working well.
More information of my journalctl:
Jan 24 12:12:53 es-usb systemd[1]: Starting Elasticsearch...
Jan 24 12:12:53 es-usb systemd[1]: Started Elasticsearch.
Jan 24 12:12:53 es-usb sudo[18774]: pam_unix(sudo:session): session closed for
user root
Jan 24 12:12:55 es-usb kernel: kernel tried to execute NX-protected page -
exploit attempt? (uid: 1000)
Jan 24 12:12:55 es-usb kernel: BUG: unable to handle kernel paging request at
00007f7d7d67e7a0
Jan 24 12:12:55 es-usb kernel: IP: 0x7f7d7d67e7a0
Jan 24 12:12:55 es-usb kernel: PGD 80000001b6e97067
Jan 24 12:12:55 es-usb kernel: P4D 80000001b6e97067
Jan 24 12:12:55 es-usb kernel: PUD 1b55fd067
Jan 24 12:12:55 es-usb kernel: PMD 1b55fc067
Jan 24 12:12:55 es-usb kernel: PTE 80000001aa5ac867
Jan 24 12:12:55 es-usb kernel:
Jan 24 12:12:55 es-usb kernel: Oops: 0011 [#7] SMP PTI
Jan 24 12:12:55 es-usb kernel: Modules linked in: xt_nat xt_tcpudp veth
ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink nfnetlink xfrm_user
xfrm_algo iptable_nat nf_nat_ipv4 xt_addrtype nf_nat br_netfilter bridge stp
llc overlay xt_multiport iptable_filter nf_conntrack_ipv4 n
Jan 24 12:12:55 es-usb kernel: hyperv_keyboard hid cfbimgblt cfbcopyarea
hv_utils ptp pps_core hv_netvsc
Jan 24 12:12:55 es-usb kernel: CPU: 0 PID: 18809 Comm: java Tainted: G D
4.13.0-1006-azure #8-Ubuntu
Jan 24 12:12:55 es-usb kernel: Hardware name: Microsoft Corporation Virtual
Machine/Virtual Machine, BIOS 090007 06/02/2017
Jan 24 12:12:55 es-usb kernel: task: ffff9c04b5e42e80 task.stack:
ffffb490c5aa0000
Jan 24 12:12:55 es-usb kernel: RIP: 0010:0x7f7d7d67e7a0
Jan 24 12:12:55 es-usb kernel: RSP: 0018:ffffb490c5aa3f50 EFLAGS: 00010202
Jan 24 12:12:55 es-usb kernel: RAX: 00000000000003e7 RBX: 0000000000000000 RCX:
00007f7d7cf914d9
Jan 24 12:12:55 es-usb kernel: RDX: 00007f7d7d67ef50 RSI: 00007f7d7d67f030 RDI:
0000000000000000
Jan 24 12:12:55 es-usb kernel: RBP: 0000000000000000 R08: 0000000000000000 R09:
000000000000000c
Jan 24 12:12:55 es-usb kernel: R10: 00007f7d7d67e7a0 R11: ffff9c04b5e42e80 R12:
0000000000000000
Jan 24 12:12:55 es-usb kernel: R13: 0000000000000000 R14: 0000000000000000 R15:
0000000000000000
Jan 24 12:12:55 es-usb kernel: FS: 00007f7d7d680700(0000)
GS:ffff9c04b9e00000(0000) knlGS:0000000000000000
Jan 24 12:12:55 es-usb kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jan 24 12:12:55 es-usb kernel: CR2: 00007f7d7d67e7a0 CR3: 00000001a33b8000 CR4:
00000000001406f0
Jan 24 12:12:55 es-usb kernel: Call Trace:
Jan 24 12:12:55 es-usb kernel: ? entry_SYSCALL_64_fastpath+0x33/0xa3
Jan 24 12:12:55 es-usb kernel: Code: Bad RIP value.
Jan 24 12:12:55 es-usb kernel: RIP: 0x7f7d7d67e7a0 RSP: ffffb490c5aa3f50
Jan 24 12:12:55 es-usb kernel: CR2: 00007f7d7d67e7a0
Jan 24 12:12:55 es-usb kernel: ---[ end trace 3100a53c6de7c0c4 ]---
Thanks for your help
Damien
** Affects: linux-azure (Ubuntu)
Importance: Undecided
Status: New
** Description changed:
Hi,
This morning I had an issue in the install of elasticsearch-2.4.6, and
when I have a look in journalctl, I have this BUG: unable to handle
kernel paging request at 00007f7d7d67e7a0
-
My configuration:
- elasticsearch@ife-es-usb-prod-master:~$ uname -r
+ elasticsearch@es-usb:~$ uname -r
4.13.0-1006-azure
When I do the downgrade on the 4.11.0-1016-azure kernel version,
everything is working well.
-
More information of my journalctl:
- Jan 24 12:12:53 ife-es-usb-prod-master systemd[1]: Starting Elasticsearch...
- Jan 24 12:12:53 ife-es-usb-prod-master systemd[1]: Started Elasticsearch.
- Jan 24 12:12:53 ife-es-usb-prod-master sudo[18774]: pam_unix(sudo:session):
session closed for user root
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: kernel tried to execute
NX-protected page - exploit attempt? (uid: 1000)
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: BUG: unable to handle kernel
paging request at 00007f7d7d67e7a0
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: IP: 0x7f7d7d67e7a0
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: PGD 80000001b6e97067
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: P4D 80000001b6e97067
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: PUD 1b55fd067
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: PMD 1b55fc067
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: PTE 80000001aa5ac867
- Jan 24 12:12:55 ife-es-usb-prod-master kernel:
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: Oops: 0011 [#7] SMP PTI
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: Modules linked in: xt_nat
xt_tcpudp veth ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink
nfnetlink xfrm_user xfrm_algo iptable_nat nf_nat_ipv4 xt_addrtype nf_nat
br_netfilter bridge stp llc overlay xt_multiport iptable_filter
nf_conntrack_ipv4 n
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: hyperv_keyboard hid cfbimgblt
cfbcopyarea hv_utils ptp pps_core hv_netvsc
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: CPU: 0 PID: 18809 Comm: java
Tainted: G D 4.13.0-1006-azure #8-Ubuntu
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: Hardware name: Microsoft
Corporation Virtual Machine/Virtual Machine, BIOS 090007 06/02/2017
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: task: ffff9c04b5e42e80
task.stack: ffffb490c5aa0000
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: RIP: 0010:0x7f7d7d67e7a0
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: RSP: 0018:ffffb490c5aa3f50
EFLAGS: 00010202
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: RAX: 00000000000003e7 RBX:
0000000000000000 RCX: 00007f7d7cf914d9
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: RDX: 00007f7d7d67ef50 RSI:
00007f7d7d67f030 RDI: 0000000000000000
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: RBP: 0000000000000000 R08:
0000000000000000 R09: 000000000000000c
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: R10: 00007f7d7d67e7a0 R11:
ffff9c04b5e42e80 R12: 0000000000000000
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: R13: 0000000000000000 R14:
0000000000000000 R15: 0000000000000000
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: FS: 00007f7d7d680700(0000)
GS:ffff9c04b9e00000(0000) knlGS:0000000000000000
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: CS: 0010 DS: 0000 ES: 0000
CR0: 0000000080050033
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: CR2: 00007f7d7d67e7a0 CR3:
00000001a33b8000 CR4: 00000000001406f0
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: Call Trace:
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: ?
entry_SYSCALL_64_fastpath+0x33/0xa3
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: Code: Bad RIP value.
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: RIP: 0x7f7d7d67e7a0 RSP:
ffffb490c5aa3f50
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: CR2: 00007f7d7d67e7a0
- Jan 24 12:12:55 ife-es-usb-prod-master kernel: ---[ end trace
3100a53c6de7c0c4 ]---
-
+ Jan 24 12:12:53 es-usb systemd[1]: Starting Elasticsearch...
+ Jan 24 12:12:53 es-usb systemd[1]: Started Elasticsearch.
+ Jan 24 12:12:53 es-usb sudo[18774]: pam_unix(sudo:session): session closed
for user root
+ Jan 24 12:12:55 es-usb kernel: kernel tried to execute NX-protected page -
exploit attempt? (uid: 1000)
+ Jan 24 12:12:55 es-usb kernel: BUG: unable to handle kernel paging request at
00007f7d7d67e7a0
+ Jan 24 12:12:55 es-usb kernel: IP: 0x7f7d7d67e7a0
+ Jan 24 12:12:55 es-usb kernel: PGD 80000001b6e97067
+ Jan 24 12:12:55 es-usb kernel: P4D 80000001b6e97067
+ Jan 24 12:12:55 es-usb kernel: PUD 1b55fd067
+ Jan 24 12:12:55 es-usb kernel: PMD 1b55fc067
+ Jan 24 12:12:55 es-usb kernel: PTE 80000001aa5ac867
+ Jan 24 12:12:55 es-usb kernel:
+ Jan 24 12:12:55 es-usb kernel: Oops: 0011 [#7] SMP PTI
+ Jan 24 12:12:55 es-usb kernel: Modules linked in: xt_nat xt_tcpudp veth
ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink nfnetlink xfrm_user
xfrm_algo iptable_nat nf_nat_ipv4 xt_addrtype nf_nat br_netfilter bridge stp
llc overlay xt_multiport iptable_filter nf_conntrack_ipv4 n
+ Jan 24 12:12:55 es-usb kernel: hyperv_keyboard hid cfbimgblt cfbcopyarea
hv_utils ptp pps_core hv_netvsc
+ Jan 24 12:12:55 es-usb kernel: CPU: 0 PID: 18809 Comm: java Tainted: G D
4.13.0-1006-azure #8-Ubuntu
+ Jan 24 12:12:55 es-usb kernel: Hardware name: Microsoft Corporation Virtual
Machine/Virtual Machine, BIOS 090007 06/02/2017
+ Jan 24 12:12:55 es-usb kernel: task: ffff9c04b5e42e80 task.stack:
ffffb490c5aa0000
+ Jan 24 12:12:55 es-usb kernel: RIP: 0010:0x7f7d7d67e7a0
+ Jan 24 12:12:55 es-usb kernel: RSP: 0018:ffffb490c5aa3f50 EFLAGS: 00010202
+ Jan 24 12:12:55 es-usb kernel: RAX: 00000000000003e7 RBX: 0000000000000000
RCX: 00007f7d7cf914d9
+ Jan 24 12:12:55 es-usb kernel: RDX: 00007f7d7d67ef50 RSI: 00007f7d7d67f030
RDI: 0000000000000000
+ Jan 24 12:12:55 es-usb kernel: RBP: 0000000000000000 R08: 0000000000000000
R09: 000000000000000c
+ Jan 24 12:12:55 es-usb kernel: R10: 00007f7d7d67e7a0 R11: ffff9c04b5e42e80
R12: 0000000000000000
+ Jan 24 12:12:55 es-usb kernel: R13: 0000000000000000 R14: 0000000000000000
R15: 0000000000000000
+ Jan 24 12:12:55 es-usb kernel: FS: 00007f7d7d680700(0000)
GS:ffff9c04b9e00000(0000) knlGS:0000000000000000
+ Jan 24 12:12:55 es-usb kernel: CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
+ Jan 24 12:12:55 es-usb kernel: CR2: 00007f7d7d67e7a0 CR3: 00000001a33b8000
CR4: 00000000001406f0
+ Jan 24 12:12:55 es-usb kernel: Call Trace:
+ Jan 24 12:12:55 es-usb kernel: ? entry_SYSCALL_64_fastpath+0x33/0xa3
+ Jan 24 12:12:55 es-usb kernel: Code: Bad RIP value.
+ Jan 24 12:12:55 es-usb kernel: RIP: 0x7f7d7d67e7a0 RSP: ffffb490c5aa3f50
+ Jan 24 12:12:55 es-usb kernel: CR2: 00007f7d7d67e7a0
+ Jan 24 12:12:55 es-usb kernel: ---[ end trace 3100a53c6de7c0c4 ]---
Thanks for your help
Damien
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1745169
Title:
Kernel tried to execute NX-protected page - exploit attempt?
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-azure/+bug/1745169/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
