Re[2]: kernel panic - what has happened: DOS attack on snort or memory error?

Hi everybody,
I use RedHat v.7.3. A few days ago I have installed a new kernel
v.2.4.27 with bridge support + iptables 1.2.11. I have applied
two patches to the kernel - 1.patch-o-matic u32 +
2.ebtables-brnf-7_vs_2.4.27.diff.gz
Also I have IDS snort Version 2.2.0 (Build 30) installed.
Everything worked propertly except a few hours ago system caught
"kernel panic"

Please help to understand what it was.
I wrote to [email protected] this question,
Martin Roesch answered me the following.

> Snort runs in userland so if there's a memory management error (out of
> mem or whatever) it should just SIGSEGV/SIGBUS or exit on a FatalError 
> (since we try to check all of our allocation return pointers).  It 
> should not be able to crash your kernel, I've never seen Snort cause a 
> kernel panic in any of my dev environments in almost 6 years of working 
> on it.
>
> I suspect your kernel upgrade has something to do with it, but it's 
> hard to say at this point.
>
>      -Marty

So, I do think it is one of my patches or physical memory error.

after kernel panic:
>> /var/log/mesages - was empty
>> and on the console I saw the following:
>> ....
>> many old messages like the last one
>> SYN/FIN: IN=bridge0 OUT-bridge0 PHYSIN=eth0 PHYSOUT=eth1
>> SRC=203.122.51.187 DST=%My_network_address% LEN=40 TOS 0x10 PREC=0x00 
>> TTL=23 ID=39426 PROTO=TCP  SPT=21 DPT=21 WINDOW=1028 RES=0x00 SYN FIN 
>> URGP=0
>> They appear when someone scans me. We can see SYN and FIN flags
>> together - that is no ok
>> after this message followed:
>>
>> Unable to handle kernel paging request ar virtual address 5d5f2739
>> printing eip:
>> c022dcdc
>> *pde=00000000
>> Oops: 0000
>> CPU: 0
>> EIP: 0010:[<c022dcdc>]          Not tained
>> EFLAGS: 00010246
>> ....
>> after that different registers, if some one need their values I can
>> send.
>> eax: .... ebx:.....
>> esi, edi, ebp esp
>> ds es ss
>> Process snort (pid: 687, stackpage=deae3000)
>> Stack: deae38a8 c02edb78   00000000 c01ebbc3 00000003 deae38e8 
>> 00000000 dfa0b004
>> c01f7500 df596078 dfa0b004 00000003 c01f7500 and etc.(if need I can
>> continue)
>> ....
>> Call Trace: [<c01ebbc3>][<c01f7500>] ......and so on half of the page
>> Code: 66 83 79 10 08 75 1d a1 2c 33  28 c0 85 c0 74 14 8b 0d 20 33
>>  <0>Kernel panic: Aiee, killing interrrupt handler!
>> In interrupt handler - not syncing
>>
>> I after hand I tried to switch eth1 link, so the following lines
>> appeared
>>  <6>eth1: link down
>> eth1: link up, 100 Mbps, ful-duplex, lpa 0x45E1
>>
>> I have a question - what it was?

Sorry for my bad English.
Thank you.
Pasha




-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl