SYSTEM_SERVICE_EXCEPTION (3b) termdd.sys

Question

Salve,

il server 2008 r2 si riavvia improvvisamente questo il messaggio:

t!KeBugCheckEx:
fffff800`03aedba0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0656a840=000000000000003b
5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003a813ef, Address of the instruction which caused the bugcheck
Arg3: fffff8800656b100, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

fffff80003c3c0e8: Unable to get Flags value from nt!KdVersionBlock
GetUlongPtrFromAddress: unable to read from fffff80003cf7300

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 6

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-P7CVNJ5

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 6

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 58

    Key  : Analysis.System
    Value: CreateObject

ADDITIONAL_XML: 1

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff80003a813ef

BUGCHECK_P3: fffff8800656b100

BUGCHECK_P4: 0

CONTEXT:  fffff8800656b100 -- (.cxr 0xfffff8800656b100)
rax=fffff8800656bb08 rbx=fffffa802631d7f8 rcx=fffffa802631d7f8
rdx=0000000000000002 rsi=0000000000000001 rdi=0000000000000000
rip=fffff80003a813ef rsp=fffff8800656bad0 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8026138450
r11=fffffa80269adb50 r12=0000000000000000 r13=fffff88001fd0180
r14=0000000000000002 r15=0000000000010224
iopl=0         nv up di pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010002
nt!ExpCheckForIoPriorityBoost+0xa7:
fffff800`03a813ef 448b6608        mov     r12d,dword ptr [rsi+8] ds:002b:00000000`00000009=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
fffff880`0656bad0 fffff800`03a82371 : fffffa80`2631d7f8 00000000`00000001 00000000`00000000 fffff880`01fd0180 : nt!ExpCheckForIoPriorityBoost+0xa7
fffff880`0656bb10 fffff800`03a8261f : ffffffff`ffb3b4c0 fffffa80`1a436d80 fffffa80`2631d7f8 fffff880`0656bd70 : nt!ExpWaitForResource+0x8d
fffff880`0656bb80 fffff800`03a824ab : fffff880`0656bd70 fffffa80`24f8c2d0 fffffa80`2631d7e0 fffff800`03a98800 : nt!ExAcquireResourceExclusiveLite+0x14f
fffff880`0656bbf0 fffff880`02fe4f4b : fffffa80`24f8c2d0 00000000`0000001f 00000000`00000000 fffff880`0656bcb0 : nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0x1b
fffff880`0656bc20 fffff880`02fe4e01 : fffffa80`23334b70 fffffa80`2505aa02 fffff8a0`062b0000 fffff880`0656be60 : termdd!IcaChannelInputInternal+0x137
fffff880`0656bd00 fffff880`0597e198 : fffff8a0`0629c1d0 fffff880`02fe9d6c fffffa80`23f24010 fffffa80`21940a20 : termdd!IcaChannelInput+0xdd
fffff880`0656bd40 fffff880`0595b708 : 00000000`00000000 fffff800`00000001 00000000`00000000 00000000`00000000 : RDPWD!SignalBrokenConnection+0x54
fffff880`0656bda0 fffff880`02fe4d8f : fffffa80`23334b70 fffffa80`23f242f0 fffffa80`23f24010 00000000`c000020d : RDPWD!WDLIB_MCSIcaChannelInput+0x90
fffff880`0656bdf0 fffff880`0593f6a4 : fffffa80`23f242f0 fffffa80`23f242f0 fffffa80`23f24010 fffffa80`23f242f0 : termdd!IcaChannelInput+0x6b
fffff880`0656be30 fffff880`02fe8f3e : fffffa80`26300010 fffffa80`25defdd0 fffffa80`26138450 fffffa80`21ead540 : tdtcp!TdInputThread+0x64c
fffff880`0656c6b0 fffff880`02fe7ae3 : fffffa80`1eb3e890 fffffa80`21ead540 fffffa80`19b6a640 fffffa80`26138450 : termdd!IcaDriverThread+0x5a
fffff880`0656c6e0 fffff880`02fe69e9 : fffffa80`25ae7b40 fffff880`0656c818 fffff880`0656c820 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
fffff880`0656c7c0 fffff880`02fe6689 : 00000000`00000000 fffffa80`21ead540 00000000`00000000 fffffa80`25ae7c58 : termdd!IcaDeviceControl+0x75
fffff880`0656c810 fffff800`03d4cd9a : 00000000`00000002 00000000`00000002 00000000`00000000 fffffa80`2456abc0 : termdd!IcaDispatch+0x215
fffff880`0656c850 fffff800`03f12831 : fffffa80`2456abc0 fffffa80`2456abc0 fffffa80`2456abc0 fffff880`01fd0180 : nt!IopSynchronousServiceTail+0xfa
fffff880`0656c8c0 fffff800`03da45d6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xc51
fffff880`0656ca00 fffff800`03afbbd3 : 00000000`80000001 fffff800`03ef2b46 00000000`00000000 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`0656ca70 00000000`76f598fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`014bfb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f598fa

SYMBOL_NAME:  termdd!IcaChannelInputInternal+137

MODULE_NAME: termdd

IMAGE_NAME:  termdd.sys

IMAGE_VERSION:  6.1.7601.17514

STACK_COMMAND:  .cxr 0xfffff8800656b100 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_c0000005_termdd!IcaChannelInputInternal+137

OS_VERSION:  7.1.7601.24384

BUILDLAB_STR:  win7sp1_ldr_escrow

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {4c4c68a5-75f3-55d4-5338-3775f67591cd}

Followup:     MachineOwner
---------

Answer 1

Ciao,
Sono Nunzio, un utente esperto dei prodotti Microsoft, benvenuto in community.

Questa è una community orientata all'uso consumer di Windows 10.
Per problemi Server puoi fare richiesta sul forum Technet, orientato all'uso Business dei prodotti Microsoft:
https://social.technet.microsoft.com/Forums/it-...

Il tuo problema è legato alla libreria che gestisce il Desktop Remoto, verifica che il sistema sia totalmente aggiornato fino alle ultime patch di Gennaio 2020, c'è un Bug sul Terminal Server che consentiva attacchi remoti.
Per ulteriori dettagli o verifiche chiedi su Technet dove troverai più facilmente risposta al tuo problema.

Answer 2

Qualora dovesse esservi di aiuto ho trovato una fix sul sito microsoft al seguente indirizzo:

http://www.catalog.update.microsoft.com/Search.aspx?q=KB4499175

La SP1 e gli ultimi aggiornamenti non risolvono il problema bisogna quindi risolvere manualmente.

Una vulnerabilità sul servizio remote desktop permette di lanciare un attacco dall'esterno tramite la porta 3389 che permette di far eseguire delle istruzioni al kernel.

La patch aggiorna il file termdd.sys ed alcune dll.

Saluti

Gianpiero