*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00007eb016e54ad7, Actual security check cookie from the stack
Arg2: 00007eb016e54417, Expected security check cookie
Arg3: ffff814fe91abbe8, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6265
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 19138
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: f7
BUGCHECK_P1: 7eb016e54ad7
BUGCHECK_P2: 7eb016e54417
BUGCHECK_P3: ffff814fe91abbe8
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 00007eb016e54417 found 00007eb016e54ad7
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
fffff800`28e68778 fffff800`2507bd95 : 00000000`000000f7 00007eb0`16e54ad7 00007eb0`16e54417 ffff814f`e91abbe8 : nt!KeBugCheckEx
fffff800`28e68780 fffff800`24e32c49 : ffffe504`c52f5328 00000012`ff7aca3f 00000012`ff7af145 fffff800`213e6180 : nt!_report_gsfailure+0x25
fffff800`28e687c0 fffff800`24e3138e : 00000000`00000000 7eb016e5`00000000 00000000`00000000 00000000`00000000 : nt!PpmIdleExecuteTransition+0x1719
fffff800`28e68b00 fffff800`24fc7614 : 00000000`00000000 fffff800`213e6180 ffffe504`caea6040 00000000`00000384 : nt!PoIdle+0x36e
fffff800`28e68c60 00000000`00000000 : fffff800`28e69000 fffff800`28e63000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x44
SYMBOL_NAME: nt!_report_gsfailure+25
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.1198
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
