我不知道这是服务器内存的问题,还是我的某个 SSD 的问题,或者是与软件相关的问题。在过去的几个月里,崩溃已经发生了 4 次以上。
我需要一些帮助来弄清楚如何尽快阻止这种情况发生。有什么想法吗?
以下是堆栈跟踪:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8029ea8ba7b, The address that the exception occurred at
Arg3: ffff928ac148b858, Exception Record Address
Arg4: ffff928ac148b070, Context Record Address
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 3936
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 3841
Key : Analysis.Init.CPU.mSec
Value: 17968
Key : Analysis.Init.Elapsed.mSec
Value: 585841
Key : Analysis.Memory.CommitPeak.Mb
Value: 130
Key : WER.OS.Branch
Value: fe_release_svc_prod2
Key : WER.OS.Timestamp
Value: 2022-07-07T18:32:00Z
Key : WER.OS.Version
Value: 10.0.20348.859
FILE_IN_CAB: MEMORY.DMP
DUMP_FILE_ATTRIBUTES: 0x1000
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8029ea8ba7b
BUGCHECK_P3: ffff928ac148b858
BUGCHECK_P4: ffff928ac148b070
EXCEPTION_RECORD: ffff928ac148b858 -- (.exr 0xffff928ac148b858)
ExceptionAddress: fffff8029ea8ba7b (HTTP!UlpGetSendCacheDataSize+0x0000000000000017)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffff928ac148b070 -- (.cxr 0xffff928ac148b070)
rax=0000000000000000 rbx=ffff80009068ed98 rcx=3a22707061222020
rdx=0000000000000000 rsi=ffffc38e63d74840 rdi=ffffc38e6414b030
rip=fffff8029ea8ba7b rsp=ffff928ac148ba98 rbp=ffff928ac148bb20
r8=0000000000000001 r9=00000000ffffffff r10=fffff80276af8d60
r11=ffff928ac148ba70 r12=0000000000000000 r13=ffffc38e6414b010
r14=ffffc38e63d748b0 r15=ffffc38e623aba80
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
HTTP!UlpGetSendCacheDataSize+0x17:
fffff802`9ea8ba7b 8b4128 mov eax,dword ptr [rcx+28h] ds:002b:3a227070`61222048=????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
READ_ADDRESS: ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffff928a`c148ba98 fffff802`9eb57402 : 00000000`00000001 ffffc38e`66bc0710 ffffc38e`646e6780 fffff802`76a3162f : HTTP!UlpGetSendCacheDataSize+0x17
ffff928a`c148baa0 fffff802`9eb2e012 : fffff802`9eb57301 fffff802`9eb33901 00000000`00000001 fffff802`9eb57380 : HTTP!UlSendCacheEntryWorker+0x82
ffff928a`c148bb60 fffff802`76b69f15 : ffffc38e`63d748b0 fffff802`9eafe580 00000000`00000480 00000000`00000000 : HTTP!UlpThreadPoolWorker+0x112
ffff928a`c148bbf0 fffff802`76c24488 : ffffad81`4ca40180 ffffc38e`646e6080 fffff802`76b69ec0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff928a`c148bc40 00000000`00000000 : ffff928a`c148c000 ffff928a`c1486000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: HTTP!UlpGetSendCacheDataSize+17
MODULE_NAME: HTTP
IMAGE_NAME: HTTP.sys
STACK_COMMAND: .cxr 0xffff928ac148b070 ; kb
BUCKET_ID_FUNC_OFFSET: 17
FAILURE_BUCKET_ID: AV_HTTP!UlpGetSendCacheDataSize
OS_VERSION: 10.0.20348.859
BUILDLAB_STR: fe_release_svc_prod2
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {640925e0-41aa-2deb-fe92-17674389e426}
Followup: MachineOwner
---------
答案1
这几乎肯定与更新有关,你并不是唯一遇到此问题的人https://learn.microsoft.com/en-us/answers/questions/1185893/windows-server-2022-standard-(21h2-20348-1547)-cra
如果我不得不猜测(我没有运行可比较的 ENV 进行测试)https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034可能是从哪里开始
或者
您的系统不包含此补丁,并且 CVE 的性质https://nvd.nist.gov/vuln/detail/CVE-2015-1635这可能表明有人正在积极尝试利用该系统。其他人开始收到错误前Apr 补丁倾向于支持这一理论。内存操作中的访问冲突也是如此!
如果存在更新,我会回滚并查看是否有帮助(如果可以,我会考虑其他缓解措施,并记住这是一个 RCE。)
如果存在,请尽可能对受影响的系统进行数据包捕获,并将实际的 Web 服务器流量与崩溃实例关联起来。这不是第一个没有完全修复导致另一个变体的漏洞的补丁,也不是第一个因为补丁不完整而导致不稳定的补丁。将结果提交给 MS,让他们检查以确保补丁是可靠的。