DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 000000009e391800, Actual security check cookie from the stack
Arg2: 0000cf8b5173e7cd, Expected security check cookie
Arg3: ffff3074ae8c1832, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3281
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6267
Key : Analysis.Init.CPU.mSec
Value: 436
Key : Analysis.Init.Elapsed.mSec
Value: 1392
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: f7
BUGCHECK_P1: 9e391800
BUGCHECK_P2: cf8b5173e7cd
BUGCHECK_P3: ffff3074ae8c1832
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000cf8b5173e7cd found 000000009e391800
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: dwm.exe
STACK_TEXT:
ffffc08a`79f417b8 fffff807`806b0a25 : 00000000`000000f7 00000000`9e391800 0000cf8b`5173e7cd ffff3074`ae8c1832 : nt!KeBugCheckEx
ffffc08a`79f417c0 fffff807`8081074f : 00000000`00000000 ffff8584`2b7b8008 00000000`00000000 00000000`00000000 : nt!_report_gsfailure+0x25
ffffc08a`79f41800 fffff807`806071b8 : 00000000`00000020 fffff807`8e73eb46 ffff8584`2d361080 ffff8584`34226a60 : nt!NtQueryInformationThread+0x2ef
ffffc08a`79f41a90 00007ff8`dac4c454 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000005`4301f518 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`dac4c454
SYMBOL_NAME: nt!_report_gsfailure+25
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------