DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 9eed0000000087d4, Actual security check cookie from the stack
Arg2: 0000b99c9eedc3ea, Expected security check cookie
Arg3: ffff466361123c15, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 9eed0000000087d4
BUGCHECK_P2: b99c9eedc3ea
BUGCHECK_P3: ffff466361123c15
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000b99c9eedc3ea found 9eed0000000087d4
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xF7
PROCESS_NAME: Origin.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:42.0743
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8040627c485 to fffff804061c14e0
STACK_TEXT:
ffffb984`49cb7818 fffff804`0627c485 : 00000000`000000f7 9eed0000`000087d4 0000b99c`9eedc3ea ffff4663`61123c15 : nt!KeBugCheckEx
ffffb984`49cb7820 fffff804`06072ec2 : 00000000`00000000 00000000`003edef8 00000000`00000001 00000000`00000000 : nt!_report_gsfailure+0x25
ffffb984`49cb7860 fffff804`061cf520 : ffffe50a`c3869080 ffffb984`49cb7a80 00000000`00544000 ffffe50a`bfec6be0 : nt!MmAccessFault+0x322
ffffb984`49cb7a00 00000000`777316ae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
00000000`003ee810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777316ae
THREAD_SHA1_HASH_MOD_FUNC: a7dfa97d75a3d26079665ff6906966f05e95116b
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 96e6575e13f68d3c9c741a111f295a559c3bc146
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!_report_gsfailure+25
fffff804`0627c485 cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!_report_gsfailure+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
TARGET_TIME: 2020-01-07T12:46:22.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3de5
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff807961d6021, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8074c43cfe0, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: fffff807961d6021
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8074c43cfe0
READ_ADDRESS: fffff8074c9733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff807961d6021
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiMayStealStandbyThread+0
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h]
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: csrss.exe
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:54.0749
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffa5818ed78090 -- (.trap 0xffffa5818ed78090)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000007 rbx=0000000000000000 rcx=ffffbc000d7c7180
rdx=fffff8074a1d0180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8074c43cfe0 rsp=ffffa5818ed78228 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000003 r10=0000000000000000
r11=fffff8074a1d0180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiMayStealStandbyThread:
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h] ds:fffff807`4a1d6021=00
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8074c5d32e9 to fffff8074c5c14e0
STACK_TEXT:
ffffa581`8ed77f48 fffff807`4c5d32e9 : 00000000`0000000a fffff807`961d6021 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffa581`8ed77f50 fffff807`4c5cf62b : 00000000`00000000 ffff9589`7c8f4100 fffff807`4a1d0180 00000000`00000002 : nt!KiBugCheckDispatch+0x69
ffffa581`8ed78090 fffff807`4c43cfe0 : fffff807`4c43c8eb 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b
ffffa581`8ed78228 fffff807`4c43c8eb : 00000000`00000000 00000000`00000000 00000000`00000000 fffff807`4ceb7c54 : nt!KiMayStealStandbyThread
ffffa581`8ed78230 fffff807`4c43c2ec : fffff807`4a1d0180 ffffa581`fffffffe ffff9589`ffffffff 00000000`00000001 : nt!KiSearchForNewThreadOnProcessor+0x3b
ffffa581`8ed782c0 fffff807`4c43b644 : ffff9589`77d7c080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x72c
ffffa581`8ed78360 fffff807`4c4884e7 : ffff9589`7c9a4000 fffff807`00000000 00000001`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x144
ffffa581`8ed78400 fffff392`0b209c86 : ffffffff`ffff8ad0 00000000`00000000 00000000`00000003 00000000`00000002 : nt!KeWaitForMultipleObjects+0x287
ffffa581`8ed78510 fffff392`0ae0c779 : 00000000`00000003 00000000`00000003 fffff392`0b121308 00000000`00000004 : win32kbase!LegacyInputDispatcher::WaitAndDispatch+0x86
ffffa581`8ed78640 fffff392`0b24e87e : ffff9589`77d7c080 ffff9589`77d7c080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0x959
ffffa581`8ed788c0 fffff392`0ae2aff0 : ffff9589`77d7c080 00000000`00000000 00000000`00000005 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x9e
ffffa581`8ed789d0 fffff807`4c5d2d15 : ffff9589`77d7c080 00000000`00000005 0000023e`0e604340 00000000`00000248 : win32kfull!NtUserCallNoParam+0x70
ffffa581`8ed78a00 00007ff9`f7fd1144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000006f`07c3fa88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`f7fd1144
THREAD_SHA1_HASH_MOD_FUNC: ce93dcacf5833022134aa6002a897ec05d7efdcc
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b81e53458752b0ac346801a7e319f05e6d97b507
THREAD_SHA1_HASH_MOD: 637ba5de44a7a77d210b2c1790ddac079fb3fbb2
FOLLOWUP_IP:
win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
fffff392`0b209c86 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 86
FAILURE_BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
PRIMARY_PROBLEM_CLASS: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
TARGET_TIME: 2020-01-07T12:56:32.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2bfd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_win32kbase!legacyinputdispatcher::waitanddispatch
FAILURE_ID_HASH: {af9493bb-0913-2c87-0cc0-f458347dea63}
Followup: MachineOwner
---------