☰

Windows Server 2022 Standard 的 HTTP 模組崩潰，導致我的伺服器重新啟動。我需要幫助找出確切的問題。如何？

tag-icon • tag-icon windows http server-crashes windows-server-2022 crash
Windows Server 2022 Standard 的 HTTP 模組崩潰，導致我的伺服器重新啟動。我需要幫助找出確切的問題。如何？

我不知道這是否是伺服器記憶體、我的 SSD 之一的問題，還是與軟體相關的問題。在過去的幾個月裡，事故已經發生了 4 次以上。

我需要一些幫助來找出如何盡快阻止這種情況發生。有任何想法嗎？

這是堆疊追蹤：

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8029ea8ba7b, The address that the exception occurred at
Arg3: ffff928ac148b858, Exception Record Address
Arg4: ffff928ac148b070, Context Record Address


KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 3936

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 3841

    Key  : Analysis.Init.CPU.mSec
    Value: 17968

    Key  : Analysis.Init.Elapsed.mSec
    Value: 585841

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 130

    Key  : WER.OS.Branch
    Value: fe_release_svc_prod2

    Key  : WER.OS.Timestamp
    Value: 2022-07-07T18:32:00Z

    Key  : WER.OS.Version
    Value: 10.0.20348.859


FILE_IN_CAB:  MEMORY.DMP

DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8029ea8ba7b

BUGCHECK_P3: ffff928ac148b858

BUGCHECK_P4: ffff928ac148b070

EXCEPTION_RECORD:  ffff928ac148b858 -- (.exr 0xffff928ac148b858)
ExceptionAddress: fffff8029ea8ba7b (HTTP!UlpGetSendCacheDataSize+0x0000000000000017)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffff928ac148b070 -- (.cxr 0xffff928ac148b070)
rax=0000000000000000 rbx=ffff80009068ed98 rcx=3a22707061222020
rdx=0000000000000000 rsi=ffffc38e63d74840 rdi=ffffc38e6414b030
rip=fffff8029ea8ba7b rsp=ffff928ac148ba98 rbp=ffff928ac148bb20
 r8=0000000000000001  r9=00000000ffffffff r10=fffff80276af8d60
r11=ffff928ac148ba70 r12=0000000000000000 r13=ffffc38e6414b010
r14=ffffc38e63d748b0 r15=ffffc38e623aba80
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
HTTP!UlpGetSendCacheDataSize+0x17:
fffff802`9ea8ba7b 8b4128          mov     eax,dword ptr [rcx+28h] ds:002b:3a227070`61222048=????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  System

READ_ADDRESS:  ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

EXCEPTION_STR:  0xc0000005

STACK_TEXT:  
ffff928a`c148ba98 fffff802`9eb57402     : 00000000`00000001 ffffc38e`66bc0710 ffffc38e`646e6780 fffff802`76a3162f : HTTP!UlpGetSendCacheDataSize+0x17
ffff928a`c148baa0 fffff802`9eb2e012     : fffff802`9eb57301 fffff802`9eb33901 00000000`00000001 fffff802`9eb57380 : HTTP!UlSendCacheEntryWorker+0x82
ffff928a`c148bb60 fffff802`76b69f15     : ffffc38e`63d748b0 fffff802`9eafe580 00000000`00000480 00000000`00000000 : HTTP!UlpThreadPoolWorker+0x112
ffff928a`c148bbf0 fffff802`76c24488     : ffffad81`4ca40180 ffffc38e`646e6080 fffff802`76b69ec0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff928a`c148bc40 00000000`00000000     : ffff928a`c148c000 ffff928a`c1486000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  HTTP!UlpGetSendCacheDataSize+17

MODULE_NAME: HTTP

IMAGE_NAME:  HTTP.sys

STACK_COMMAND:  .cxr 0xffff928ac148b070 ; kb

BUCKET_ID_FUNC_OFFSET:  17

FAILURE_BUCKET_ID:  AV_HTTP!UlpGetSendCacheDataSize

OS_VERSION:  10.0.20348.859

BUILDLAB_STR:  fe_release_svc_prod2

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {640925e0-41aa-2deb-fe92-17674389e426}

Followup:     MachineOwner
---------

答案1

這幾乎肯定與更新有關，到目前為止，您並不是唯一擁有該更新的人https://learn.microsoft.com/en-us/answers/questions/1185893/windows-server-2022-standard-(21h2-20348-1547)-cra

如果我必須猜測（我沒有運行類似的 ENV 來測試）https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034可能從哪裡開始

或者

您的系統不包含此補丁以及 CVE 的性質https://nvd.nist.gov/vuln/detail/CVE-2015-1635這可能表明有人正在積極嘗試利用該系統。事實上其他人開始遇到錯誤前Apr 補丁傾向於支援這個理論。

如果有更新，我會回滾並查看是否有幫助（如果可以的話，我會考慮其他緩解措施，並記住這是一個 RCE。）

如果存在，則在可行的情況下對受影響的系統進行封包捕獲，並將 Web 伺服器的實際流量與崩潰實例相關聯。不會是第一個未完全獲得導致另一個變體的錯誤的補丁，也不會因為補丁不完整而導致不穩定。將結果交給 MS，讓他們檢查以確保補丁正確。

相關內容