I have a similar problem with vmlinuz-2.6.22-15-xen: in that moment I see many attempt to log in via ssh; then the server is blocked and I can't even ping it. it have 9 GB of RAM
------------------- Jul 10 01:32:48 hypervisor kernel: [1075570.401200] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) Jul 10 01:32:48 hypervisor kernel: [1075570.401262] BUG: unable to handle kernel paging request at virtual address c210a680 Jul 10 01:32:48 hypervisor kernel: [1075570.401317] printing eip: Jul 10 01:32:48 hypervisor kernel: [1075570.401342] c210a680 Jul 10 01:32:48 hypervisor kernel: [1075570.401345] 01d2c000 -> *pde = 00000000:7fd30001 Jul 10 01:32:48 hypervisor kernel: [1075570.401375] 01d30000 -> *pme = 00000000:7e001067 Jul 10 01:32:48 hypervisor kernel: [1075570.401404] 00001000 -> *pte = 80000002:7b90a063 Jul 10 01:32:48 hypervisor kernel: [1075570.401436] Oops: 0011 [#1] Jul 10 01:32:48 hypervisor kernel: [1075570.401461] SMP Jul 10 01:32:48 hypervisor kernel: [1075570.401493] Modules linked in: xt_tcpudp xt_physdev iptable_filter ip_tables x_tables af_packet bridge lp loop sr_mod cdrom s erial_core pc spkr parport_pc parport shpchp pci_hotplug ipv6 evdev ext3 jbd mbcache sg sd_mod ata_piix floppy tg3 ata_generic libata ehci_hcd uhci_hcd usbcore mptsas mptscsih mptbase scsi_tra nsport_sas scsi_mod thermal processor fan fuse apparmor commoncap Jul 10 01:32:48 hypervisor kernel: [1075570.401822] CPU: 0 Jul 10 01:32:48 hypervisor kernel: [1075570.401823] EIP: 0061:[<c210a680>] Not tainted VLI Jul 10 01:32:48 hypervisor kernel: [1075570.401824] EFLAGS: 00210206 (2.6.22-15-xen #1) Jul 10 01:32:48 hypervisor kernel: [1075570.401907] EIP is at 0xc210a680 Jul 10 01:32:48 hypervisor kernel: [1075570.401934] eax: c201a660 ebx: c201a660 ecx: c03c0c00 edx: 00000000 Jul 10 01:32:48 hypervisor kernel: [1075570.401968] esi: d356dec4 edi: 00040000 ebp: 00000000 esp: d356de94 Jul 10 01:32:48 hypervisor kernel: [1075570.402012] ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0069 Jul 10 01:32:48 hypervisor kernel: [1075570.402051] Process sshd (pid: 25153, ti=d356c000 task=dabf6000 task.ti=d356c000) Jul 10 01:32:48 hypervisor kernel: [1075570.402085] Stack: c01569b9 00000000 c03c0c00 00000004 d356dec4 c14662a4 00000007 c0156a4f Jul 10 01:32:48 hypervisor kernel: [1075570.402176] c201a180 c03c0c00 c01598e6 00000007 00000007 00000000 c2142300 c2018540 Jul 10 01:32:48 hypervisor kernel: [1075570.402261] c201bda0 c2018260 c20f05c0 c201a660 c201a180 c201ba60 d3474ff8 bffaafff Jul 10 01:32:48 hypervisor kernel: [1075570.402347] Call Trace: Jul 10 01:32:48 hypervisor kernel: [1075570.402392] [free_hot_cold_page+393/512] free_hot_cold_page+0x189/0x200 Jul 10 01:32:48 hypervisor kernel: [1075570.402433] [__pagevec_free+31/48] __pagevec_free+0x1f/0x30 Jul 10 01:32:48 hypervisor kernel: [1075570.402468] [release_pages+390/496] release_pages+0x186/0x1f0 Jul 10 01:32:48 hypervisor kernel: [1075570.402508] [free_pages_and_swap_cache+116/160] free_pages_and_swap_cache+0x74/0xa0 Jul 10 01:32:48 hypervisor kernel: [1075570.402546] [exit_mmap+225/240] exit_mmap+0xe1/0xf0 Jul 10 01:32:48 hypervisor kernel: [1075570.402582] [mmput+56/160] mmput+0x38/0xa0 Jul 10 01:32:48 hypervisor kernel: [1075570.402616] [do_exit+289/2128] do_exit+0x121/0x850 Jul 10 01:32:48 hypervisor kernel: [1075570.402651] [vfs_read+340/352] vfs_read+0x154/0x160 Jul 10 01:32:48 hypervisor kernel: [1075570.402688] [do_group_exit+38/144] do_group_exit+0x26/0x90 Jul 10 01:32:48 hypervisor kernel: [1075570.402723] [syscall_call+7/11] syscall_call+0x7/0xb Jul 10 01:32:48 hypervisor kernel: [1075570.402761] ======================= Jul 10 01:32:48 hypervisor kernel: [1075570.402787] Code: ad 34 c2 00 01 10 00 00 02 20 00 00 00 00 00 01 00 00 00 ff ff ff ff 78 71 43 c0 00 00 00 00 a0 a6 10 c2 00 01 10 00 00 02 20 00 <00> 00 00 00 01 00 00 00 ff ff ff ff 74 a6 01 c2 00 00 00 00 c0 Jul 10 01:32:48 hypervisor kernel: [1075570.403143] EIP: [<c210a680>] 0xc210a680 SS:ESP 0069:d356de94 Jul 10 01:32:48 hypervisor kernel: [1075570.403856] Fixing recursive fault but reboot is needed!
I have a similar problem with vmlinuz- 2.6.22- 15-xen: in that moment I see many attempt to log in via ssh; then the server is blocked and I can't even ping it.
it have 9 GB of RAM
------------------- cold_page+ 393/512] free_hot_ cold_page+ 0x189/0x200 free+31/ 48] __pagevec_ free+0x1f/ 0x30 pages+390/ 496] release_ pages+0x186/ 0x1f0 and_swap_ cache+116/ 160] free_pages_ and_swap_ cache+0x74/ 0xa0 0x154/0x160 exit+38/ 144] do_group_ exit+0x26/ 0x90 call+0x7/ 0xb ======= ======= ==
Jul 10 01:32:48 hypervisor kernel: [1075570.401200] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
Jul 10 01:32:48 hypervisor kernel: [1075570.401262] BUG: unable to handle kernel paging request at virtual address c210a680
Jul 10 01:32:48 hypervisor kernel: [1075570.401317] printing eip:
Jul 10 01:32:48 hypervisor kernel: [1075570.401342] c210a680
Jul 10 01:32:48 hypervisor kernel: [1075570.401345] 01d2c000 -> *pde = 00000000:7fd30001
Jul 10 01:32:48 hypervisor kernel: [1075570.401375] 01d30000 -> *pme = 00000000:7e001067
Jul 10 01:32:48 hypervisor kernel: [1075570.401404] 00001000 -> *pte = 80000002:7b90a063
Jul 10 01:32:48 hypervisor kernel: [1075570.401436] Oops: 0011 [#1]
Jul 10 01:32:48 hypervisor kernel: [1075570.401461] SMP
Jul 10 01:32:48 hypervisor kernel: [1075570.401493] Modules linked in: xt_tcpudp xt_physdev iptable_filter ip_tables x_tables af_packet bridge lp loop sr_mod cdrom s erial_core pc spkr parport_pc parport shpchp pci_hotplug ipv6 evdev ext3 jbd mbcache sg sd_mod ata_piix floppy tg3 ata_generic libata ehci_hcd uhci_hcd usbcore mptsas mptscsih mptbase scsi_tra nsport_sas scsi_mod thermal processor fan fuse apparmor commoncap
Jul 10 01:32:48 hypervisor kernel: [1075570.401822] CPU: 0
Jul 10 01:32:48 hypervisor kernel: [1075570.401823] EIP: 0061:[<c210a680>] Not tainted VLI
Jul 10 01:32:48 hypervisor kernel: [1075570.401824] EFLAGS: 00210206 (2.6.22-15-xen #1)
Jul 10 01:32:48 hypervisor kernel: [1075570.401907] EIP is at 0xc210a680
Jul 10 01:32:48 hypervisor kernel: [1075570.401934] eax: c201a660 ebx: c201a660 ecx: c03c0c00 edx: 00000000
Jul 10 01:32:48 hypervisor kernel: [1075570.401968] esi: d356dec4 edi: 00040000 ebp: 00000000 esp: d356de94
Jul 10 01:32:48 hypervisor kernel: [1075570.402012] ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0069
Jul 10 01:32:48 hypervisor kernel: [1075570.402051] Process sshd (pid: 25153, ti=d356c000 task=dabf6000 task.ti=d356c000)
Jul 10 01:32:48 hypervisor kernel: [1075570.402085] Stack: c01569b9 00000000 c03c0c00 00000004 d356dec4 c14662a4 00000007 c0156a4f
Jul 10 01:32:48 hypervisor kernel: [1075570.402176] c201a180 c03c0c00 c01598e6 00000007 00000007 00000000 c2142300 c2018540
Jul 10 01:32:48 hypervisor kernel: [1075570.402261] c201bda0 c2018260 c20f05c0 c201a660 c201a180 c201ba60 d3474ff8 bffaafff
Jul 10 01:32:48 hypervisor kernel: [1075570.402347] Call Trace:
Jul 10 01:32:48 hypervisor kernel: [1075570.402392] [free_hot_
Jul 10 01:32:48 hypervisor kernel: [1075570.402433] [__pagevec_
Jul 10 01:32:48 hypervisor kernel: [1075570.402468] [release_
Jul 10 01:32:48 hypervisor kernel: [1075570.402508] [free_pages_
Jul 10 01:32:48 hypervisor kernel: [1075570.402546] [exit_mmap+225/240] exit_mmap+0xe1/0xf0
Jul 10 01:32:48 hypervisor kernel: [1075570.402582] [mmput+56/160] mmput+0x38/0xa0
Jul 10 01:32:48 hypervisor kernel: [1075570.402616] [do_exit+289/2128] do_exit+0x121/0x850
Jul 10 01:32:48 hypervisor kernel: [1075570.402651] [vfs_read+340/352] vfs_read+
Jul 10 01:32:48 hypervisor kernel: [1075570.402688] [do_group_
Jul 10 01:32:48 hypervisor kernel: [1075570.402723] [syscall_call+7/11] syscall_
Jul 10 01:32:48 hypervisor kernel: [1075570.402761] =======
Jul 10 01:32:48 hypervisor kernel: [1075570.402787] Code: ad 34 c2 00 01 10 00 00 02 20 00 00 00 00 00 01 00 00 00 ff ff ff ff 78 71 43 c0 00 00 00 00 a0 a6 10 c2 00 01 10 00 00 02 20 00 <00> 00 00 00 01 00 00 00 ff ff ff ff 74 a6 01 c2 00 00 00 00 c0
Jul 10 01:32:48 hypervisor kernel: [1075570.403143] EIP: [<c210a680>] 0xc210a680 SS:ESP 0069:d356de94
Jul 10 01:32:48 hypervisor kernel: [1075570.403856] Fixing recursive fault but reboot is needed!