kernel tried to execute NX-protected page - exploit attempt?

[VecH]

Proxmox 4.1 release and full update
VM Ubuntu 14.04 + full update

Today found that one virtual machine to stop responding to the WEB GUI can be seen that the virtual machine is turned off

Spoiler: Package versions

# pveversion --verbose
proxmox-ve: 4.1-39 (running kernel: 4.2.8-1-pve)
pve-manager: 4.1-15 (running version: 4.1-15/8cd55b52)
pve-kernel-4.2.8-1-pve: 4.2.8-39
lvm2: 2.02.116-pve2
corosync-pve: 2.3.5-2
libqb0: 1.0-1
pve-cluster: 4.0-33
qemu-server: 4.0-62
pve-firmware: 1.1-7
libpve-common-perl: 4.0-49
libpve-access-control: 4.0-11
libpve-storage-perl: 4.0-42
pve-libspice-server1: 0.12.5-2
vncterm: 1.2-1
pve-qemu-kvm: 2.5-8
pve-container: 1.0-46
pve-firewall: 2.0-18
pve-ha-manager: 1.0-23
ksm-control-daemon: 1.2-1
glusterfs-client: 3.5.2-2+deb8u1
lxc-pve: 1.1.5-7
lxcfs: 2.0.0-pve1
cgmanager: 0.39-pve1
criu: 1.6.0-1

The logs can be seen here are:

Spoiler: kernel tried to execute NX-protected page - exploit attempt?

Mar 03 22:24:43 host kernel: BUG: unable to handle kernel paging request at ffff8801971c3eb8
Mar 03 22:24:41 host rrdcached[1218]: removing old journal /var/lib/rrdcached/journal/rrd.journal.1457007881.649824
Mar 03 22:24:43 host kernel: kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
Mar 03 22:24:43 host kernel: BUG: unable to handle kernel paging request at ffff8801971c3eb8
Mar 03 22:24:43 host kernel: IP: [<ffff8801971c3eb8>] 0xffff8801971c3eb8
Mar 03 22:24:43 host kernel: PGD 220d067 PUD 2210067 PMD 19795d063 PTE 80000001971c3163
Mar 03 22:24:43 host kernel: Oops: 0011 [#1] SMP
Mar 03 22:24:43 host kernel: Modules linked in: ip_set ip6table_filter ip6_tables zram lz4_compress iptable_filter ip_tables x_tab
Mar 03 22:24:43 host kernel:  i2c_i801 ie31200_edac intel_smartconnect edac_core mac_hid vhost_net vhost macvtap macvlan autofs4 r
Mar 03 22:24:43 host kernel: CPU: 0 PID: 1415 Comm: kvm Not tainted 4.2.8-1-pve #1
Mar 03 22:24:43 host kernel: Hardware name: System manufacturer System Product Name/P8H77-M, BIOS 1306 03/07/2014
Mar 03 22:24:43 host kernel: task: ffff880035dab700 ti: ffff8801971c0000 task.ti: ffff8801971c0000
Mar 03 22:24:43 host kernel: RIP: 0010:[<ffff8801971c3eb8>]  [<ffff8801971c3eb8>] 0xffff8801971c3eb8
Mar 03 22:24:43 host kernel: RSP: 0018:ffff8801971c3a90  EFLAGS: 00010202
Mar 03 22:24:43 host kernel: RAX: 0000000000000004 RBX: 0000000000000000 RCX: 0000000000000019
Mar 03 22:24:43 host kernel: RDX: 0000000000000000 RSI: 0000000000004000 RDI: 000000000000002c
Mar 03 22:24:43 host kernel: RBP: ffffffff8121b563 R08: 0000000000000001 R09: ffff8800120c0900
Mar 03 22:24:43 host kernel: R10: ffff8800120c0938 R11: ffff880035e9e3c0 R12: 0000000000000000
Mar 03 22:24:43 host kernel: R13: ffff8801971c3c04 R14: ffff8801971c3bb4 R15: 0000000000000001
Mar 03 22:24:43 host kernel: FS:  00007f79ac507b40(0000) GS:ffff88019fa00000(0000) knlGS:0000000000000000
Mar 03 22:24:43 host kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 03 22:24:43 host kernel: CR2: ffff8801971c3eb8 CR3: 0000000197080000 CR4: 00000000001426f0
Mar 03 22:24:43 host kernel: Stack:
Mar 03 22:24:43 host kernel:  ffffffff812134ef ffff8801971c3b48 00007f79750b3c00 ffff8801971c4000
Mar 03 22:24:43 host kernel:  ffff880035dab700 0000000000000000 ffff8801971c3f00 0000000000000174
Mar 03 22:24:43 host kernel:  ffff8801971c3b00 0000000001000001 ffff8801971c3b08 ffff8800120c0901
Mar 03 22:24:43 host kernel: Call Trace:
Mar 03 22:24:43 host kernel:  [<ffffffff812134ef>] ? do_sys_poll+0x2df/0x5b0
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81213add>] ? SyS_ppoll+0x17d/0x1b0
Mar 03 22:24:43 host kernel:  [<ffffffff81809a32>] ? entry_SYSCALL_64_fastpath+0x16/0x75
Mar 03 22:24:43 host kernel: Code: 88 ff ff 00 00 00 00 00 00 00 00 d0 7e a0 50 fc 7f 00 00 08 00 00 00 00 00 00 00 00 3c 0b 75 79
Mar 03 22:24:43 host kernel: RIP  [<ffff8801971c3eb8>] 0xffff8801971c3eb8
Mar 03 22:24:43 host kernel:  RSP <ffff8801971c3a90>
Mar 03 22:24:43 host kernel: CR2: ffff8801971c3eb8

This is repeated is not the first time did not pay attention earlier.
What is the problem and how to fix it?

 

[VecH]

And VM not started from WEB GUI and console

Spoiler: syslog

Mar  3 22:55:22 host pvedaemon[12130]: <root@pam> successful auth for user 'root@pam'
Mar  3 23:00:22 host pvedaemon[12129]: <root@pam> starting task UPID:host:000065B2:0529A5C4:56D85186:vncshell::root@pam:
Mar  3 23:00:22 host pvedaemon[26034]: starting vnc proxy UPID:host:000065B2:0529A5C4:56D85186:vncshell::root@pam:
Mar  3 23:00:22 host pvedaemon[26034]: launch command: /usr/bin/vncterm -rfbport 5900 -timeout 10 -authpath /nodes/host -perm Sys.Console -notls -listen localhost -c /bin/bash -l
Mar  3 23:00:24 host pvedaemon[12130]: update new package list: /var/lib/pve-manager/pkgupdates
Mar  3 23:03:53 host pvedaemon[12131]: <root@pam> starting task UPID:host:00006696:0529F83C:56D85259:qmstart:100:root@pam:
Mar  3 23:03:53 host pvedaemon[26262]: start VM 100: UPID:host:00006696:0529F83C:56D85259:qmstart:100:root@pam:
Mar  3 23:03:54 host pvedaemon[26262]: start failed: command '/usr/bin/systemd-run --scope --slice qemu --unit 100 -p 'KillMode=none' -p 'CPUShares=1000' /usr/bin/kvm -id 100 -chardev 'socket,id=qmp,path=/var/run/qemu-server/100.qmp,server,nowait' -mon 'chardev=qmp,mode=control' -pidfile /var/run/qemu-server/100.pid -daemonize -smbios 'type=1,uuid=640fdd2d-c1c2-4301-b896-3e195f513b73' -name big -smp '2,sockets=1,cores=2,maxcpus=2' -nodefaults -boot 'menu=on,strict=on,reboot-timeout=1000' -vga cirrus -vnc unix:/var/run/qemu-server/100.vnc,x509,password -cpu kvm64,+lahf_lm,+sep,+kvm_pv_unhalt,+kvm_pv_eoi,enforce -m 512 -k en-us -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' -device 'piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2' -readconfig /usr/share/qemu-server/pve-usb.cfg -device 'usb-tablet,id=tablet,bus=uhci.0,port=1' -device 'usb-host,hostbus=3,hostport=1.1' -device 'usb-host,hostbus=3,hostport=1.2' -chardev 'socket,path=/var/run/qemu-server/100.qga,server,nowait,id=qga0' -device 'virtio-serial,id=qga0,bus=pci.0,addr=0x8' -device 'virtserialport,chardev=qga0,name=org.qemu.guest_agent.0' -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3' -iscsi 'initiator-name=iqn.1993-08.org.debian:01:e8911eda0f' -drive 'file=/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E0287422,if=none,id=drive-virtio1,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio1,id=virtio1,bus=pci.0,addr=0xb' -drive 'file=/var/lib/vz/images/100/vm-100-disk-1.qcow2,if=none,id=drive-virtio0,format=qcow2,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio0,id=virtio0,bus=pci.0,addr=0xa,bootindex=101' -drive 'if=none,id=drive-ide2,media=cdrom,aio=threads' -device 'ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=200' -netdev 'type=tap,id=net0,ifname=tap100i0,script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown' -device 'e1000,mac=3A:61:61:33:36:35,netdev=net0,bus=pci.0,addr=0x12,id=net0'' failed: exit code 1
Mar  3 23:04:05 host pveproxy[12139]: worker exit
Mar  3 23:04:05 host pveproxy[11415]: worker 12139 finished
Mar  3 23:04:05 host pveproxy[11415]: starting 1 worker(s)
Mar  3 23:04:05 host pveproxy[11415]: worker 26272 started
Mar  3 23:05:20 host qm[26337]: <root@pam> starting task UPID:host:000066E2:052A1A1B:56D852B0:qmstart:100:root@pam:
Mar  3 23:05:20 host qm[26338]: start VM 100: UPID:host:000066E2:052A1A1B:56D852B0:qmstart:100:root@pam:
Mar  3 23:05:20 host qm[26338]: start failed: command '/usr/bin/systemd-run --scope --slice qemu --unit 100 -p 'KillMode=none' -p 'CPUShares=1000' /usr/bin/kvm -id 100 -chardev 'socket,id=qmp,path=/var/run/qemu-server/100.qmp,server,nowait' -mon 'chardev=qmp,mode=control' -pidfile /var/run/qemu-server/100.pid -daemonize -smbios 'type=1,uuid=640fdd2d-c1c2-4301-b896-3e195f513b73' -name big -smp '2,sockets=1,cores=2,maxcpus=2' -nodefaults -boot 'menu=on,strict=on,reboot-timeout=1000' -vga cirrus -vnc unix:/var/run/qemu-server/100.vnc,x509,password -cpu kvm64,+lahf_lm,+sep,+kvm_pv_unhalt,+kvm_pv_eoi,enforce -m 512 -k en-us -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' -device 'piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2' -readconfig /usr/share/qemu-server/pve-usb.cfg -device 'usb-tablet,id=tablet,bus=uhci.0,port=1' -device 'usb-host,hostbus=3,hostport=1.1' -device 'usb-host,hostbus=3,hostport=1.2' -chardev 'socket,path=/var/run/qemu-server/100.qga,server,nowait,id=qga0' -device 'virtio-serial,id=qga0,bus=pci.0,addr=0x8' -device 'virtserialport,chardev=qga0,name=org.qemu.guest_agent.0' -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3' -iscsi 'initiator-name=iqn.1993-08.org.debian:01:e8911eda0f' -drive 'file=/var/lib/vz/images/100/vm-100-disk-1.qcow2,if=none,id=drive-virtio0,format=qcow2,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio0,id=virtio0,bus=pci.0,addr=0xa,bootindex=100' -drive 'file=/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E0287422,if=none,id=drive-virtio1,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio1,id=virtio1,bus=pci.0,addr=0xb' -drive 'if=none,id=drive-ide2,media=cdrom,aio=threads' -device 'ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=200' -netdev 'type=tap,id=net0,ifname=tap100i0,script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown' -device 'e1000,mac=3A:61:61:33:36:35,netdev=net0,bus=pci.0,addr=0x12,id=net0'' failed: exit code 1
Mar  3 23:05:20 host qm[26337]: <root@pam> end task UPID:host:000066E2:052A1A1B:56D852B0:qmstart:100:root@pam: start failed: command '/usr/bin/systemd-run --scope --slice qemu --unit 100 -p 'KillMode=none' -p 'CPUShares=1000' /usr/bin/kvm -id 100 -chardev 'socket,id=qmp,path=/var/run/qemu-server/100.qmp,server,nowait' -mon 'chardev=qmp,mode=control' -pidfile /var/run/qemu-server/100.pid -daemonize -smbios 'type=1,uuid=640fdd2d-c1c2-4301-b896-3e195f513b73' -name big -smp '2,sockets=1,cores=2,maxcpus=2' -nodefaults -boot 'menu=on,strict=on,reboot-timeout=1000' -vga cirrus -vnc unix:/var/run/qemu-server/100.vnc,x509,password -cpu kvm64,+lahf_lm,+sep,+kvm_pv_unhalt,+kvm_pv_eoi,enforce -m 512 -k en-us -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' -device 'piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2' -readconfig /usr/share/qemu-server/pve-usb.cfg -device 'usb-tablet,id=tablet,bus=uhci.0,port=1' -device 'usb-host,hostbus=3,hostport=1.1' -device 'usb-host,hostbus=3,hostport=1.2' -chardev 'socket,path=/var/run/qemu-server/100.qga,server,nowait,id=qga0' -device 'virtio-serial,id=qga0,bus=pci.0,addr=0x8' -device 'virtserialport,chardev=qga0,name=org.qemu.guest_agent.0' -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3' -iscsi 'initiator-name=iqn.1993-08.org.debian:01:e8911eda0f' -drive 'file=/var/lib/vz/images/100/vm-100-disk-1.qcow2,if=none,id=drive-virtio0,format=qcow2,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio0,id=virtio0,bus=pci.0,addr=0xa,bootindex=100' -drive 'file=/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E0287422,if=none,id=drive-virtio1,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio1,id=virtio1,bus=pci.0,addr=0xb' -drive 'if=none,id=drive-ide2,media=cdrom,aio=threads' -device 'ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=200' -netdev 'type=tap,id=net0,ifname=tap100i0,script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown' -device 'e1000,mac=3A:61:61:33:36:35,netdev=net0,bus=pci.0,addr=0x12,id=net0'' failed: exit code 1

 

[sdinet]

This thread discusses what you encountered a little bit:
http://cboard.cprogramming.com/linu...ted-page-linux-kernel-module-development.html

Are these logs in your first screenshot from the Proxmox host itself?

 

[VecH]

I create screen from other PC connected to HOST proxmox over ssh and see logs

 

[sdinet]

Do you have network traffic alert logs and other asset logs available for review? Have you restarted proxmox host yet?

 

[VecH]

Yes, the host is rebooted
The network 3 computers, host, my PC and laptop Internet connection through a router with NAT, forward ports do not use