kernel tried to execute NX-protected page - exploit attempt?

VecH

Renowned Member
Sep 12, 2015
49
0
71
Proxmox 4.1 release and full update
VM Ubuntu 14.04 + full update

Today found that one virtual machine to stop responding to the WEB GUI can be seen that the virtual machine is turned off
# pveversion --verbose
proxmox-ve: 4.1-39 (running kernel: 4.2.8-1-pve)
pve-manager: 4.1-15 (running version: 4.1-15/8cd55b52)
pve-kernel-4.2.8-1-pve: 4.2.8-39
lvm2: 2.02.116-pve2
corosync-pve: 2.3.5-2
libqb0: 1.0-1
pve-cluster: 4.0-33
qemu-server: 4.0-62
pve-firmware: 1.1-7
libpve-common-perl: 4.0-49
libpve-access-control: 4.0-11
libpve-storage-perl: 4.0-42
pve-libspice-server1: 0.12.5-2
vncterm: 1.2-1
pve-qemu-kvm: 2.5-8
pve-container: 1.0-46
pve-firewall: 2.0-18
pve-ha-manager: 1.0-23
ksm-control-daemon: 1.2-1
glusterfs-client: 3.5.2-2+deb8u1
lxc-pve: 1.1.5-7
lxcfs: 2.0.0-pve1
cgmanager: 0.39-pve1
criu: 1.6.0-1
The logs can be seen here are:
Скриншот 2016-03-03 22.43.09.png
Code:
Mar 03 22:24:43 host kernel: BUG: unable to handle kernel paging request at ffff8801971c3eb8
Mar 03 22:24:41 host rrdcached[1218]: removing old journal /var/lib/rrdcached/journal/rrd.journal.1457007881.649824
Mar 03 22:24:43 host kernel: kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
Mar 03 22:24:43 host kernel: BUG: unable to handle kernel paging request at ffff8801971c3eb8
Mar 03 22:24:43 host kernel: IP: [<ffff8801971c3eb8>] 0xffff8801971c3eb8
Mar 03 22:24:43 host kernel: PGD 220d067 PUD 2210067 PMD 19795d063 PTE 80000001971c3163
Mar 03 22:24:43 host kernel: Oops: 0011 [#1] SMP
Mar 03 22:24:43 host kernel: Modules linked in: ip_set ip6table_filter ip6_tables zram lz4_compress iptable_filter ip_tables x_tab
Mar 03 22:24:43 host kernel:  i2c_i801 ie31200_edac intel_smartconnect edac_core mac_hid vhost_net vhost macvtap macvlan autofs4 r
Mar 03 22:24:43 host kernel: CPU: 0 PID: 1415 Comm: kvm Not tainted 4.2.8-1-pve #1
Mar 03 22:24:43 host kernel: Hardware name: System manufacturer System Product Name/P8H77-M, BIOS 1306 03/07/2014
Mar 03 22:24:43 host kernel: task: ffff880035dab700 ti: ffff8801971c0000 task.ti: ffff8801971c0000
Mar 03 22:24:43 host kernel: RIP: 0010:[<ffff8801971c3eb8>]  [<ffff8801971c3eb8>] 0xffff8801971c3eb8
Mar 03 22:24:43 host kernel: RSP: 0018:ffff8801971c3a90  EFLAGS: 00010202
Mar 03 22:24:43 host kernel: RAX: 0000000000000004 RBX: 0000000000000000 RCX: 0000000000000019
Mar 03 22:24:43 host kernel: RDX: 0000000000000000 RSI: 0000000000004000 RDI: 000000000000002c
Mar 03 22:24:43 host kernel: RBP: ffffffff8121b563 R08: 0000000000000001 R09: ffff8800120c0900
Mar 03 22:24:43 host kernel: R10: ffff8800120c0938 R11: ffff880035e9e3c0 R12: 0000000000000000
Mar 03 22:24:43 host kernel: R13: ffff8801971c3c04 R14: ffff8801971c3bb4 R15: 0000000000000001
Mar 03 22:24:43 host kernel: FS:  00007f79ac507b40(0000) GS:ffff88019fa00000(0000) knlGS:0000000000000000
Mar 03 22:24:43 host kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 03 22:24:43 host kernel: CR2: ffff8801971c3eb8 CR3: 0000000197080000 CR4: 00000000001426f0
Mar 03 22:24:43 host kernel: Stack:
Mar 03 22:24:43 host kernel:  ffffffff812134ef ffff8801971c3b48 00007f79750b3c00 ffff8801971c4000
Mar 03 22:24:43 host kernel:  ffff880035dab700 0000000000000000 ffff8801971c3f00 0000000000000174
Mar 03 22:24:43 host kernel:  ffff8801971c3b00 0000000001000001 ffff8801971c3b08 ffff8800120c0901
Mar 03 22:24:43 host kernel: Call Trace:
Mar 03 22:24:43 host kernel:  [<ffffffff812134ef>] ? do_sys_poll+0x2df/0x5b0
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81212160>] ? poll_select_copy_remaining+0x140/0x140
Mar 03 22:24:43 host kernel:  [<ffffffff81213add>] ? SyS_ppoll+0x17d/0x1b0
Mar 03 22:24:43 host kernel:  [<ffffffff81809a32>] ? entry_SYSCALL_64_fastpath+0x16/0x75
Mar 03 22:24:43 host kernel: Code: 88 ff ff 00 00 00 00 00 00 00 00 d0 7e a0 50 fc 7f 00 00 08 00 00 00 00 00 00 00 00 3c 0b 75 79
Mar 03 22:24:43 host kernel: RIP  [<ffff8801971c3eb8>] 0xffff8801971c3eb8
Mar 03 22:24:43 host kernel:  RSP <ffff8801971c3a90>
Mar 03 22:24:43 host kernel: CR2: ffff8801971c3eb8

This is repeated is not the first time did not pay attention earlier.
What is the problem and how to fix it?
 
And VM not started from WEB GUI and console
Code:
Mar  3 22:55:22 host pvedaemon[12130]: <root@pam> successful auth for user 'root@pam'
Mar  3 23:00:22 host pvedaemon[12129]: <root@pam> starting task UPID:host:000065B2:0529A5C4:56D85186:vncshell::root@pam:
Mar  3 23:00:22 host pvedaemon[26034]: starting vnc proxy UPID:host:000065B2:0529A5C4:56D85186:vncshell::root@pam:
Mar  3 23:00:22 host pvedaemon[26034]: launch command: /usr/bin/vncterm -rfbport 5900 -timeout 10 -authpath /nodes/host -perm Sys.Console -notls -listen localhost -c /bin/bash -l
Mar  3 23:00:24 host pvedaemon[12130]: update new package list: /var/lib/pve-manager/pkgupdates
Mar  3 23:03:53 host pvedaemon[12131]: <root@pam> starting task UPID:host:00006696:0529F83C:56D85259:qmstart:100:root@pam:
Mar  3 23:03:53 host pvedaemon[26262]: start VM 100: UPID:host:00006696:0529F83C:56D85259:qmstart:100:root@pam:
Mar  3 23:03:54 host pvedaemon[26262]: start failed: command '/usr/bin/systemd-run --scope --slice qemu --unit 100 -p 'KillMode=none' -p 'CPUShares=1000' /usr/bin/kvm -id 100 -chardev 'socket,id=qmp,path=/var/run/qemu-server/100.qmp,server,nowait' -mon 'chardev=qmp,mode=control' -pidfile /var/run/qemu-server/100.pid -daemonize -smbios 'type=1,uuid=640fdd2d-c1c2-4301-b896-3e195f513b73' -name big -smp '2,sockets=1,cores=2,maxcpus=2' -nodefaults -boot 'menu=on,strict=on,reboot-timeout=1000' -vga cirrus -vnc unix:/var/run/qemu-server/100.vnc,x509,password -cpu kvm64,+lahf_lm,+sep,+kvm_pv_unhalt,+kvm_pv_eoi,enforce -m 512 -k en-us -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' -device 'piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2' -readconfig /usr/share/qemu-server/pve-usb.cfg -device 'usb-tablet,id=tablet,bus=uhci.0,port=1' -device 'usb-host,hostbus=3,hostport=1.1' -device 'usb-host,hostbus=3,hostport=1.2' -chardev 'socket,path=/var/run/qemu-server/100.qga,server,nowait,id=qga0' -device 'virtio-serial,id=qga0,bus=pci.0,addr=0x8' -device 'virtserialport,chardev=qga0,name=org.qemu.guest_agent.0' -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3' -iscsi 'initiator-name=iqn.1993-08.org.debian:01:e8911eda0f' -drive 'file=/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E0287422,if=none,id=drive-virtio1,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio1,id=virtio1,bus=pci.0,addr=0xb' -drive 'file=/var/lib/vz/images/100/vm-100-disk-1.qcow2,if=none,id=drive-virtio0,format=qcow2,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio0,id=virtio0,bus=pci.0,addr=0xa,bootindex=101' -drive 'if=none,id=drive-ide2,media=cdrom,aio=threads' -device 'ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=200' -netdev 'type=tap,id=net0,ifname=tap100i0,script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown' -device 'e1000,mac=3A:61:61:33:36:35,netdev=net0,bus=pci.0,addr=0x12,id=net0'' failed: exit code 1
Mar  3 23:04:05 host pveproxy[12139]: worker exit
Mar  3 23:04:05 host pveproxy[11415]: worker 12139 finished
Mar  3 23:04:05 host pveproxy[11415]: starting 1 worker(s)
Mar  3 23:04:05 host pveproxy[11415]: worker 26272 started
Mar  3 23:05:20 host qm[26337]: <root@pam> starting task UPID:host:000066E2:052A1A1B:56D852B0:qmstart:100:root@pam:
Mar  3 23:05:20 host qm[26338]: start VM 100: UPID:host:000066E2:052A1A1B:56D852B0:qmstart:100:root@pam:
Mar  3 23:05:20 host qm[26338]: start failed: command '/usr/bin/systemd-run --scope --slice qemu --unit 100 -p 'KillMode=none' -p 'CPUShares=1000' /usr/bin/kvm -id 100 -chardev 'socket,id=qmp,path=/var/run/qemu-server/100.qmp,server,nowait' -mon 'chardev=qmp,mode=control' -pidfile /var/run/qemu-server/100.pid -daemonize -smbios 'type=1,uuid=640fdd2d-c1c2-4301-b896-3e195f513b73' -name big -smp '2,sockets=1,cores=2,maxcpus=2' -nodefaults -boot 'menu=on,strict=on,reboot-timeout=1000' -vga cirrus -vnc unix:/var/run/qemu-server/100.vnc,x509,password -cpu kvm64,+lahf_lm,+sep,+kvm_pv_unhalt,+kvm_pv_eoi,enforce -m 512 -k en-us -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' -device 'piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2' -readconfig /usr/share/qemu-server/pve-usb.cfg -device 'usb-tablet,id=tablet,bus=uhci.0,port=1' -device 'usb-host,hostbus=3,hostport=1.1' -device 'usb-host,hostbus=3,hostport=1.2' -chardev 'socket,path=/var/run/qemu-server/100.qga,server,nowait,id=qga0' -device 'virtio-serial,id=qga0,bus=pci.0,addr=0x8' -device 'virtserialport,chardev=qga0,name=org.qemu.guest_agent.0' -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3' -iscsi 'initiator-name=iqn.1993-08.org.debian:01:e8911eda0f' -drive 'file=/var/lib/vz/images/100/vm-100-disk-1.qcow2,if=none,id=drive-virtio0,format=qcow2,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio0,id=virtio0,bus=pci.0,addr=0xa,bootindex=100' -drive 'file=/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E0287422,if=none,id=drive-virtio1,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio1,id=virtio1,bus=pci.0,addr=0xb' -drive 'if=none,id=drive-ide2,media=cdrom,aio=threads' -device 'ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=200' -netdev 'type=tap,id=net0,ifname=tap100i0,script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown' -device 'e1000,mac=3A:61:61:33:36:35,netdev=net0,bus=pci.0,addr=0x12,id=net0'' failed: exit code 1
Mar  3 23:05:20 host qm[26337]: <root@pam> end task UPID:host:000066E2:052A1A1B:56D852B0:qmstart:100:root@pam: start failed: command '/usr/bin/systemd-run --scope --slice qemu --unit 100 -p 'KillMode=none' -p 'CPUShares=1000' /usr/bin/kvm -id 100 -chardev 'socket,id=qmp,path=/var/run/qemu-server/100.qmp,server,nowait' -mon 'chardev=qmp,mode=control' -pidfile /var/run/qemu-server/100.pid -daemonize -smbios 'type=1,uuid=640fdd2d-c1c2-4301-b896-3e195f513b73' -name big -smp '2,sockets=1,cores=2,maxcpus=2' -nodefaults -boot 'menu=on,strict=on,reboot-timeout=1000' -vga cirrus -vnc unix:/var/run/qemu-server/100.vnc,x509,password -cpu kvm64,+lahf_lm,+sep,+kvm_pv_unhalt,+kvm_pv_eoi,enforce -m 512 -k en-us -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' -device 'piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2' -readconfig /usr/share/qemu-server/pve-usb.cfg -device 'usb-tablet,id=tablet,bus=uhci.0,port=1' -device 'usb-host,hostbus=3,hostport=1.1' -device 'usb-host,hostbus=3,hostport=1.2' -chardev 'socket,path=/var/run/qemu-server/100.qga,server,nowait,id=qga0' -device 'virtio-serial,id=qga0,bus=pci.0,addr=0x8' -device 'virtserialport,chardev=qga0,name=org.qemu.guest_agent.0' -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3' -iscsi 'initiator-name=iqn.1993-08.org.debian:01:e8911eda0f' -drive 'file=/var/lib/vz/images/100/vm-100-disk-1.qcow2,if=none,id=drive-virtio0,format=qcow2,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio0,id=virtio0,bus=pci.0,addr=0xa,bootindex=100' -drive 'file=/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E0287422,if=none,id=drive-virtio1,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'virtio-blk-pci,drive=drive-virtio1,id=virtio1,bus=pci.0,addr=0xb' -drive 'if=none,id=drive-ide2,media=cdrom,aio=threads' -device 'ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=200' -netdev 'type=tap,id=net0,ifname=tap100i0,script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown' -device 'e1000,mac=3A:61:61:33:36:35,netdev=net0,bus=pci.0,addr=0x12,id=net0'' failed: exit code 1
 
I create screen from other PC connected to HOST proxmox over ssh and see logs
 
Do you have network traffic alert logs and other asset logs available for review? Have you restarted proxmox host yet?
 
Yes, the host is rebooted
The network 3 computers, host, my PC and laptop Internet connection through a router with NAT, forward ports do not use
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!