Segfault error: 15

[kailashkkd]

Hi Everyone,

I have a vm with centos 7.3 running with kernel version: kernel-3.10.0-514.21.1.el7.x86_64
I am seeing the below segfault errors in the messages file.
Jun 13 16:03:42 msfwex02-srv-p4 kernel: anonmap[30831]: segfault at 7fcf26d84000 ip 00007fcf26d84000 sp 00007ffdefbfb128 error 15
Jun 13 16:03:42 msfwex02-srv-p4 kernel: execbss[30837]: segfault at 6020ac ip 00000000006020ac sp 00007fffab471008 error 15 in execbss[602000+1000]
Jun 13 16:03:42 msfwex02-srv-p4 kernel: execdata[30843]: segfault at 60209c ip 000000000060209c sp 00007ffd6ef85c68 error 15 in execdata[602000+1000]
Jun 13 16:03:42 msfwex02-srv-p4 kernel: execheap[30849]: segfault at b0b250 ip 0000000000b0b250 sp 00007fffb8c74ec8 error 15
Jun 13 16:03:42 msfwex02-srv-p4 kernel: execstack[30855]: segfault at 7ffeae8fd4a0 ip 00007ffeae8fd4a0 sp 00007ffeae8fd498 error 15
Jun 13 16:03:42 msfwex02-srv-p4 kernel: shlibbss[31109]: segfault at 7f0469104060 ip 00007f0469104060 sp 00007ffd7ea0fe58 error 15 in shlibtest2.so[7f0469103000+2000]
Jun 13 16:03:42 msfwex02-srv-p4 kernel: shlibdata[31115]: segfault at 7fcc3362b040 ip 00007fcc3362b040 sp 00007ffc31ee7128 error 15 in shlibtest2.so[7fcc3362b000+2000]


Any idea on why this may be happening

[avij]

anonmap, execbss, execdata, execheap, execstack, shlibbss, shlibdata -- what are those programs? They are not CentOS programs. Based on the file names, I get the impression that those programs were written to test if, for example, the stack portion of your program is executable. Those programs may be used to find vulnerabilities on your system. Unless you can find an explanation for those (ask around from anyone who has access to that server), there's a chance that your server has been compromised.

[avij]

Likely source of those messages: paxtest. That is not a CentOS package either. Hopefully its installation was authorized by you.

[kailashkkd]

i dont think the vm is compromised

i am not sure, why this logs are coming, and the time its coming, i am not able to login into the vm