linux-kernel - Re: bad pmd ffff810000207808(9090909090909090).

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080506195014.GS8474@1wt.eu>
Date:	Tue, 6 May 2008 21:50:15 +0200
From:	Willy Tarreau <w@....eu>
To:	OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
Cc:	Jan Engelhardt <jengelh@...ozas.de>, linux-kernel@...r.kernel.org,
	linux-mm@...ck.org
Subject: Re: bad pmd ffff810000207808(9090909090909090).

On Tue, May 06, 2008 at 09:52:58PM +0900, OGAWA Hirofumi wrote:
> Jan Engelhardt <jengelh@...ozas.de> writes:
> 
> > On Tuesday 2008-05-06 14:00, OGAWA Hirofumi wrote:
> >
> >>I've found today the following error in syslog. It seems have a strange
> >>pattern. And it also happened at a month ago.
> >>
> >>Any idea for debuging this?
> >>
> >
> > 90 is NOP on x86, perhaps something got rooted?
> 
> I see. I'm not sure, but I didn't notice this soon, maybe it worked as
> almost usual.

I got immediate same feeling as Jan here. It looks very much like someone
has tried to inject code into your system. The problem is that you don't
know if this finally succeeded. Maybe some backdoor is now installed in
your kernel. If I were you, I would isolate the machine, reboot it on CD
and check MD5s (particularly the ones of the kernel and modules) before
rebooting it.

Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/