-
Notifications
You must be signed in to change notification settings - Fork 162
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* add segfault detection through kern.log, syslog or journalctl -k --------- Co-authored-by: GitHub Action <[email protected]>
- Loading branch information
1 parent
70d0ca1
commit 7386a8f
Showing
13 changed files
with
299 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| 2023-10-05T11:47:20.799042+02:00 leto kernel: [869507.505196] su[1433535]: segfault at 7f1f9b891000 ip 00007f1f9b870d7d sp 00007ffd5dab97f0 error 6 in ld-linux-x86-64.so.2[7f1f9b85e000+25000] likely on CPU 2 (core 2, socket 0) | ||
| 2023-10-05T11:47:20.799052+02:00 leto kernel: [869507.505206] Code: c0 0f 85 24 01 00 00 4c 89 f0 b9 01 00 00 00 45 84 c9 0f 84 40 01 00 00 48 8b 44 24 18 4c 89 e6 48 29 c6 48 89 c1 48 83 c0 01 <45> 88 4c 06 ff 44 0f b6 0c 06 45 84 c9 75 ea 48 8d 71 02 4c 01 f0 | ||
| 2023-10-05T11:47:58.015019+02:00 leto kernel: [869544.717859] usb 5-2.3.3: current rate 16000 is different from the runtime rate 32000 | ||
| 2023-10-05T11:49:27.299005+02:00 leto kernel: [869634.002922] su[1436247]: segfault at 7f69e5a10000 ip 00007f69e59efd7d sp 00007ffff8da8b50 error 6 in ld-linux-x86-64.so.2[7f69e59dd000+25000] likely on CPU 3 (core 3, socket 0) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| parsers: | ||
| - crowdsecurity/syslog-logs | ||
| - crowdsecurity/dateparse-enrich | ||
| - ./parsers/s01-parse/crowdsecurity/segfault-logs.yaml | ||
| scenarios: | ||
| - ./scenarios/crowdsecurity/CVE-2023-4911.yaml | ||
| postoverflows: | ||
| - "" | ||
| log_file: CVE-2023-4911.log | ||
| log_type: syslog | ||
| labels: {} | ||
| ignore_parsers: true | ||
| override_statics: [] |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| len(results) == 2 | ||
| "su" in results[0].Overflow.GetSources() | ||
| results[0].Overflow.Sources["su"].IP == "" | ||
| results[0].Overflow.Sources["su"].Range == "" | ||
| results[0].Overflow.Sources["su"].GetScope() == "exe" | ||
| results[0].Overflow.Sources["su"].GetValue() == "su" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("binary") == "su" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("datasource_path") == "CVE-2023-4911.log" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("library") == "ld-linux-x86-64.so.2" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "kernel" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("machine") == "leto" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("sub_log_type") == "segfault" | ||
| results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2023-10-05T11:47:20.799042+02:00" | ||
| results[0].Overflow.Alert.GetScenario() == "crowdsecurity/CVE-2023-4911" | ||
| results[0].Overflow.Alert.Remediation == false | ||
| results[0].Overflow.Alert.GetEventsCount() == 1 | ||
| "su" in results[1].Overflow.GetSources() | ||
| results[1].Overflow.Sources["su"].IP == "" | ||
| results[1].Overflow.Sources["su"].Range == "" | ||
| results[1].Overflow.Sources["su"].GetScope() == "exe" | ||
| results[1].Overflow.Sources["su"].GetValue() == "su" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("binary") == "su" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("datasource_path") == "CVE-2023-4911.log" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("library") == "ld-linux-x86-64.so.2" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("log_type") == "kernel" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("machine") == "leto" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("sub_log_type") == "segfault" | ||
| results[1].Overflow.Alert.Events[0].GetMeta("timestamp") == "2023-10-05T11:49:27.299005+02:00" | ||
| results[1].Overflow.Alert.GetScenario() == "crowdsecurity/CVE-2023-4911" | ||
| results[1].Overflow.Alert.Remediation == false | ||
| results[1].Overflow.Alert.GetEventsCount() == 1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| parsers: | ||
| - crowdsecurity/syslog-logs | ||
| - crowdsecurity/dateparse-enrich | ||
| - ./parsers/s01-parse/crowdsecurity/segfault-logs.yaml | ||
| scenarios: | ||
| - "" | ||
| postoverflows: | ||
| - "" | ||
| log_file: segfault-logs.log | ||
| log_type: syslog | ||
| labels: {} | ||
| ignore_parsers: false | ||
| override_statics: [] |
Oops, something went wrong.