DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: ffffc7035ba5a888, Actual security check cookie from the stack
Arg2: 0000bad8e29cf8ba, Expected security check cookie
Arg3: ffff45271d630745, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 5220
BIOS_DATE: 09/12/2019
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: ROG STRIX B350-F GAMING
BASEBOARD_VERSION: Rev X.0x
DUMP_TYPE: 2
BUGCHECK_P1: ffffc7035ba5a888
BUGCHECK_P2: bad8e29cf8ba
BUGCHECK_P3: ffff45271d630745
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000bad8e29cf8ba found ffffc7035ba5a888
CPU_COUNT: c
CPU_MHZ: c7a
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xF7
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-07-2020 01:09:19.0138
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LOCK_ADDRESS: fffff8076c262940 -- (!locks fffff8076c262940)
Cannot get _ERESOURCE type
Resource @ nt!PiEngineLock (0xfffff8076c262940) Available
1 total locks
PNP_TRIAGE_DATA:
Lock address : 0xfffff8076c262940
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from fffff8076c07c8a5 to fffff8076bfc2380
STACK_TEXT:
ffffc703`5ba59638 fffff807`6c07c8a5 : 00000000`000000f7 ffffc703`5ba5a888 0000bad8`e29cf8ba ffff4527`1d630745 : nt!KeBugCheckEx
ffffc703`5ba59640 fffff807`6bfa2c82 : ffffb48f`b58a6080 ffffb48f`aa0b34e0 00000001`ffffffff fffffff6`0000000d : nt!_report_gsfailure+0x25
ffffc703`5ba59680 fffff807`6bfa2c17 : 00040021`00050401 fffff807`6befe23e 00000000`01000000 00000000`00000000 : nt!_GSHandlerCheckCommon+0x5a
ffffc703`5ba596b0 fffff807`6bfcb1b2 : fffff807`6c311000 fffff807`6be00000 0005e38c`00ab7000 00000000`0010001f : nt!_GSHandlerCheck+0x13
ffffc703`5ba596e0 fffff807`6befa2d5 : ffffc703`5ba5a648 00000000`00000000 ffffc703`5ba59c50 00007fff`ffff0000 : nt!RtlpExecuteHandlerForException+0x12
ffffc703`5ba59710 fffff807`6befe86e : ffffc703`5ba5a648 ffffc703`5ba5a390 ffffc703`5ba5a648 00000000`00000018 : nt!RtlDispatchException+0x4a5
ffffc703`5ba59e60 fffff807`6bfd431d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x16e
ffffc703`5ba5a510 fffff807`6bfce8ab : ffffc703`5ba5a760 ffffc703`5ba5ab80 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x11d
ffffc703`5ba5a6f0 fffff807`6c500010 : fffff807`6c47fdc2 ffffc803`adeb8a10 ffffc803`adeb8a01 0000001d`284ff1c8 : nt!KiInvalidOpcodeFault+0x32b
ffffc703`5ba5a888 ffffb48f`b2636480 : fffff807`00000001 ffffb48f`aa0f8980 ffffb48f`aa3da001 00000000`00000000 : nt!PipChangeDeviceObjectFromRegistryProperties+0x6c
ffffc703`5ba5a988 fffff807`00000001 : ffffb48f`aa0f8980 ffffb48f`aa3da001 00000000`00000000 00000000`00000001 : 0xffffb48f`b2636480
ffffc703`5ba5a990 ffffb48f`aa0f8980 : ffffb48f`aa3da001 00000000`00000000 00000000`00000001 00000000`00000000 : 0xfffff807`00000001
ffffc703`5ba5a998 ffffb48f`aa3da001 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : 0xffffb48f`aa0f8980
ffffc703`5ba5a9a0 00000000`00000000 : 00000000`00000001 00000000`00000000 00000000`00000000 ffffb48f`b232cca0 : 0xffffb48f`aa3da001
THREAD_SHA1_HASH_MOD_FUNC: 5623a1b98475ed6ab422ac153734b81ff4cf1dbe
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 7ad2c9f635f506810a75d2f7d9c01177b7a094a4
THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406
FOLLOWUP_IP:
nt!_report_gsfailure+25
fffff807`6c07c8a5 cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!_report_gsfailure+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.720
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
TARGET_TIME: 2020-04-06T18:00:43.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 33a2
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000158, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8057049f94a, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 5220
BIOS_DATE: 09/12/2019
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: ROG STRIX B350-F GAMING
BASEBOARD_VERSION: Rev X.0x
DUMP_TYPE: 2
BUGCHECK_P1: 158
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8057049f94a
READ_ADDRESS: fffff8055f9733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000158
CURRENT_IRQL: 2
FAULTING_IP:
atikmdag+20f94a
fffff805`7049f94a 48ffa0a0000000 jmp qword ptr [rax+0A0h]
CPU_COUNT: c
CPU_MHZ: c7a
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-07-2020 01:09:22.0856
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
TRAP_FRAME: ffffa00888708f00 -- (.trap 0xffffa00888708f00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000b8 rbx=0000000000000000 rcx=ffffe48b0d4ee000
rdx=0000000000003235 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8057049f94a rsp=ffffa00888709098 rbp=ffff8101f795f000
r8=0000000000000008 r9=0000000000000000 r10=ffffe48b0d277020
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
atikmdag+0x20f94a:
fffff805`7049f94a 48ffa0a0000000 jmp qword ptr [rax+0A0h] ds:00000000`00000158=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8055f5d41e9 to fffff8055f5c2380
STACK_TEXT:
ffffa008`88708db8 fffff805`5f5d41e9 : 00000000`0000000a 00000000`00000158 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffa008`88708dc0 fffff805`5f5d052b : 00000000`00000000 00000000`00000000 ffffe48b`0d435940 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffa008`88708f00 fffff805`7049f94a : fffff805`703e75ea 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b
ffffa008`88709098 fffff805`703e75ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x20f94a
ffffa008`887090a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffa008`88709140 : atikmdag+0x1575ea
THREAD_SHA1_HASH_MOD_FUNC: 599d6bac727a7dc4c2deaaba368bf39f0552a408
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 0a60bce9537530db5e742d075a11974e575e74c9
THREAD_SHA1_HASH_MOD: a6f113c5e53eddd87cfcc157a65a419ce56e9d25
FOLLOWUP_IP:
atikmdag+20f94a
fffff805`7049f94a 48ffa0a0000000 jmp qword ptr [rax+0A0h]
FAULT_INSTR_CODE: a0a0ff48
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: atikmdag+20f94a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5e84ec45
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 20f94a
FAILURE_BUCKET_ID: AV_atikmdag!unknown_function
BUCKET_ID: AV_atikmdag!unknown_function
PRIMARY_PROBLEM_CLASS: AV_atikmdag!unknown_function
TARGET_TIME: 2020-04-06T19:07:06.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 13af6
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_atikmdag!unknown_function
FAILURE_ID_HASH: {0252e3ed-fc29-a2ca-0f7a-b32a5492113a}
Followup: MachineOwner
---------
