general/6208: Kernel panic... apache or kernel problem ?

[Boris Hajduk <ha...@epita.fr>]

>Number:         6208
>Category:       general
>Synopsis:       Kernel panic... apache or  kernel problem ?
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Mon Jun 19 03:40:03 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator:     hajduk_b@epita.fr
>Release:        1.3.6
>Organization:
apache
>Environment:
RedHat-6.1  kernel 2.2.12-20smp  gcc  uid=nobody
I am the only one to have an account on that server (no local-exploit)


Server version: Apache/1.3.6 (Unix)
Server built:   Feb 18 2000 21:04:42
Server's Module Magic Number: 19990320:0
Server compiled with....
 -D HAVE_MMAP
 -D HAVE_SHMGET
 -D USE_SHMGET_SCOREBOARD
 -D USE_MMAP_FILES
 -D USE_FCNTL_SERIALIZED_ACCEPT
 -D HTTPD_ROOT="/usr/local/apache"
 -D SUEXEC_BIN="/usr/local/apache/bin/suexec"
 -D SHARED_CORE_DIR="/usr/local/apache/libexec"
 -D DEFAULT_PIDLOG="logs/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/httpd.scoreboard"
 -D DEFAULT_LOCKFILE="logs/httpd.lock"
 -D DEFAULT_XFERLOG="logs/access_log"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D TYPES_CONFIG_FILE="conf/mime.types"
 -D SERVER_CONFIG_FILE="conf/httpd.conf"
 -D ACCESS_CONFIG_FILE="conf/access.conf"
 -D RESOURCE_CONFIG_FILE="conf/srm.conf"
>Description:
I've read in #hackers that my site was going to be attacked on Jun, 2nd;
and they successfully get my site down.


Jun  2 18:13:06 localhost kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000008
Jun  2 18:13:06 localhost kernel: current->tss.cr3 = 1a57d000, %cr3 = 1a57d000
Jun  2 18:13:06 localhost kernel: *pde = 00000000
Jun  2 18:13:06 localhost kernel: Oops: 0000
Jun  2 18:13:06 localhost kernel: CPU:    0
Jun  2 18:13:06 localhost kernel: EIP:    0010:[tcp_v4_unhash+120/172]
Jun  2 18:13:06 localhost kernel: EFLAGS: 00010282
Jun  2 18:13:06 localhost kernel: eax: cc1891e8   ebx: db139c80   ecx: 00000000   edx: cc189a80
Jun  2 18:13:06 localhost kernel: esi: db139c80   edi: df458f00   ebp: d375c91c   esp: c5f63ec8
Jun  2 18:13:06 localhost kernel: ds: 0018   es: 0018   ss: 0018
Jun  2 18:13:06 localhost kernel: Process httpd (pid: 14940, process nr: 97, stackpage=c5f63000)
Jun  2 18:13:06 localhost kernel: Stack: db139c80 ffffff8f df459480 c017625b db139c80 d375c91c ddee4a2c d375c880
Jun  2 18:13:06 localhost kernel:        c5f62000 c0150088 ddee4a2c d375c91c 00000002 00000004 4000a610 bffffe64
Jun  2 18:13:06 localhost kernel:        bffffcd4 cca6fcc0 00000000 00000007 c731249c cca6fcc0 c5f63f24 00000001
Jun  2 18:13:06 localhost kernel: Call Trace: [inet_accept+215/252] [sys_accept+144/356] [sys_fcntl+764/948] [sys_fcntl+917/948] [sys_socketcall+176/480] [system_call+52/56]
Jun  2 18:13:06 localhost kernel: Code: 83 79 08 00 75 24 8b 51 04 85 d2 74 09 8b 41 0c 89 42 0c 8b
Jun  2 20:36:17 localhost syslogd 1.3-3: restart.



There is nothing in error_log (no segfault)
The kernel did panic, and I needed to hard-reset the computer.
Could it be a kernel problem ?

no core file available
>How-To-Repeat:
unknown
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <ap...@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]