Suricata fails segfault libmagic

[CamiloPerezOrtiz]

Suricata fails randomly in the log shows:

Jun 4 14:17:29 ips kernel: [842348.379241] W-NFQ#2[15863]: segfault at 7f0003ffb0a4 ip 00007f01b8282dfd sp 00007f01af2e0580 error 4 in libmagic.so.1.0.0[7f01b8276000+18000] Jun 4 14:17:29 ips kernel: [842348.379247] Code: 49 8d be 9d 00 00 00 4c 89 e3 49 8d b6 9c 00 00 00 eb 17 66 2e 0f 1f 84 00 00 00 00 00 48 83 c3 01 48 39 fb 0f 84 33 01 00 00 <0f> b6 0b 48 89 f2 48 29 da 48 89 c8 41 f6 44 48 01 20 75 df 48 85

It's running in nfqueue mode.

suricata --build-info

This is Suricata version 6.0.2 RELEASE Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST SIMD support: none Atomic intrinsics: 1 2 4 8 byte(s) 64-bits, Little-endian architecture GCC version 8.3.0, C version 201112 compiled with -fstack-protector compiled with _FORTIFY_SOURCE=2 L1 cache line size (CLS)=64 thread local storage method: _Thread_local compiled with LibHTP v0.5.37, linked against LibHTP v0.5.37

Suricata Configuration: AF_PACKET support: yes eBPF support: no XDP support: no PF_RING support: no NFQueue support: yes NFLOG support: no IPFW support: no Netmap support: no DAG enabled: no Napatech enabled: no WinDivert enabled: no

Unix socket enabled: yes Detection enabled: yes

Libmagic support: yes libnss support: yes libnspr support: yes libjansson support: yes hiredis support: no hiredis async with libevent: no Prelude support: no PCRE jit: yes LUA support: yes, through luajit libluajit: yes GeoIP2 support: yes Non-bundled htp: no Hyperscan support: yes Libnet support: yes liblz4 support: no

Rust support: yes Rust strict mode: no Rust compiler path: /root/.cargo/bin/rustc Rust compiler version: rustc 1.52.1 (9bc8c42bb 2021-05-09) Cargo path: /root/.cargo/bin/cargo Cargo version: cargo 1.52.0 (69767412a 2021-04-21) Cargo vendor: yes

Python support: yes Python path: /usr/bin/python3 Python distutils yes Python yaml yes Install suricatactl: yes Install suricatasc: yes Install suricata-update: yes

Profiling enabled: no Profiling locks enabled: no

Plugin support (experimental): yes

Development settings: Coccinelle / spatch: no Unit tests enabled: no Debug output enabled: no Debug validation enabled: no

Generic build parameters: Installation prefix: /usr Configuration directory: /etc/suricata/ Log directory: /var/log/suricata/

--prefix /usr --sysconfdir /etc --localstatedir /var --datarootdir /usr/share

Host: x86_64-pc-linux-gnu Compiler: gcc (exec name) / g++ (real) GCC Protect enabled: yes GCC march native enabled: no GCC Profile enabled: no Position Independent Executable enabled: yes CFLAGS -g -O2 -std=c11 -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist PCAP_CFLAGS -I/usr/include SECCFLAGS -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security

Any ideas how to fix? Thanks!

[pevma]

Thank you for reporting this. Just to confirm - you are running SELKS with Suricata 6.0.2, correct?

Can you please open a redmine ticket on the suricata project https://redmine.openinfosecfoundation.org/projects/suricata/issues ?

Is it possible to recompile with ./configure YOUR_USUAL_FLAGS CFLAGS="-ggdb -O0" or install the provided debug package in SELKS (suricata-dbg) so more useful info can be generated.

[CamiloPerezOrtiz]

Hi, @pevma thanks for your response

yes, I compiled the latest stable version of suricata, I supposed with this version could avoid the problem, but it wasn't

[pevma]

Ok - can you please open a redmine ticket and add in the build info output?
Also probably bets to try to use the dbg pkg to see if we can get a meaningful core.

[pevma]

@CamiloPerezOrtiz - do you still experience this problem ?

[CamiloPerezOrtiz]

Hi @pevma, yes I already published the bug, but they still do not respond This is link https://redmine.openinfosecfoundation.org/issues/4520 I'm on hold

[pevma]

@CamiloPerezOrtiz - can you confirm that with git master as well? (the default Suricata in SELKS)