BugCheck D1 error for mfefirek.sys (post installation)
Technical Articles ID:
KB76593
Last Modified: 6/6/2022
Last Modified: 6/6/2022
Environment
Host Intrusion Prevention (Host IPS) 8.0
Problem 1
A system crash or blue screen occurs for mfefirek.sys after you install Host IPS 8.0 Patch 2.
The error below is displayed in the resulting dump file:
BugCheck D1
The error below is displayed in the resulting dump file:
Problem 2
Packet meta values are incorrectly set to 0 for the transport and IP header lengths. As a result, the firewall packet validations aren't initialized correctly and a D1 bug check might occur for the Mfefirek.sys filtering driver.
NOTE: This issue does not occur on all VPN versions, but might occur on some VPN versions. We recommend that customers validate their specific VPN versions on Host IPSPatch 2 (8.0.0.2151) before deployment on production systems.
We confirm that the issue can occur on the following VPN versions.
NOTE: This issue does not occur on all VPN versions, but might occur on some VPN versions. We recommend that customers validate their specific VPN versions on Host IPS
We confirm that the issue can occur on the following VPN versions.
| Windows 7 x86 | Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Win | 3.0.7012.0 | |
| Windows 7 x64 | Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Win x64 | 3.0.7012.0 | |
| Windows 7 SP1 x64 | Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Win x64 | 3.0.2032.0 | |
| Windows 7 SP1 x64 | Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Win x64 | 3.1.234.0 | |
| Windows 7 SP1 x64 | Research In Motion VPN | 1.1.0.3 | |
| Windows 7 SP1 x86 | F5 networks VPN Adapter/Citrix ICA for XenApp | 6030.2009.514.2218 | |
| Juniper Network Connect Virtual Adapter | 7.2.0.7478 |
System Change
You installed Host IPS Patch 2, version (8.0.0.2151).
Cause
Our analysis indicates that the issue occurs within the Windows Filter Platform (WFP) framework during network packet filtering by the WFP driver.
Solution 1
For systems currently running Host IPS Patch 2 (8.0.0.2151):
You might or might not be experiencing intermittent system instability on some client systems. For full resolution of this issue, customers can directly update their systems to thePatch 2 Hotfix 803520 rollup, which fully resolves this issue. Currently, Hotfix 803520 is in managed release and available from Technical Support. For details, see KB77323 - Host IPS 8.0.0 Patch 2 Hotfix Rollup 803520 Release Notes.
For systems not currently running Host IPSPatch 2:
This issue might occur with thePatch 2 (8.0.0.2151) version. So, we recommend that you validate and test your specific VPN versions, or any other products using the Windows Filter Platform (WFP) driver architecture, before deployment on production systems.
If prior testing validation isn't possible, we recommend customers running the above VPN versions, or other products using the WFP, to perform the following:
You might or might not be experiencing intermittent system instability on some client systems. For full resolution of this issue, customers can directly update their systems to the
For systems not currently running Host IPS
This issue might occur with the
If prior testing validation isn't possible, we recommend customers running the above VPN versions, or other products using the WFP, to perform the following:
- First, apply Hotfix 833271.
- Then, upgrade to Host IPS 8.0
Patch 2.
See KB77324 - Host IPS 8.0.0 Patch 1 Hotfix 833271 Release Notes for Release Notes and additional information about remediation for this issue. After upgrading to Host IPS 8.0 Patch 2, the above issue will be resolved.
NOTE: We recommend you then upgrade systems to HF803520 to apply all available fixes in that hotfix update. But, it isn't required to resolve this specific issue if HF833271 is applied before you upgrade toPatch 2. For details, see KB77323 - Host IPS 8.0.0 Patch 2 Hotfix Rollup 803520 Release Notes.
NOTE: We recommend you then upgrade systems to HF803520 to apply all available fixes in that hotfix update. But, it isn't required to resolve this specific issue if HF833271 is applied before you upgrade to
NOTES:
- Hotfix 833271 can be installed on either Host IPS 8.0 GA (8.0.0.1741) or
Patch 1 (8.0.0.1919) systems before installingPatch 2 (8.0.0.2151). - HF833271 prevents systems installed with certain VPN filter drivers from incurring a D1 bug check, after an upgrade to
Patch 2. Contact Technical Support and request Hotfix HostIPS_Client800_HotFix833271.zip for this issue.
To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.
IMPORTANT: The following files are required for Technical Support:- Minimum Escalation Requirements (MER) files for your specific product. For information about downloading the MERs for each product, see KB59385 - How to use MER tools with supported products.
- Other files and logs, as requested by Technical Support.
Solution 2
Recommended Repository Check-in Procedure
This product update deployment task is configured for multiple update packages on a single managed product. When you check in multiple product update packages (hotfixes orpatch updates) for a single managed product, note the following:
This product update deployment task is configured for multiple update packages on a single managed product. When you check in multiple product update packages (hotfixes or
- Check in all related update packages into the ePolicy Orchestrator (ePO) repository branch that you want.
- Check in the packages in the correct order of deployment.
- Don't move or copy multiple packages, which are used for a single managed product update task, from one ePO branch to another.
To change ePO deployment branches when managing multiple package deployments (for example, from Evaluation to Current), perform the following:
- Delete all related packages from the first deployment branch.
NOTE: Deletion of the existing packages from a repository branch is the only effective means to make sure that correct deployment detection script sequencing is maintained for multiple package deployments.
- Recheck the multiple packages into the new repository branch in the deployment order needed.
- To update specific client systems from specific ePO repository branches, change the McAfee Agent (MA) policy settings for those systems. The Host IPS updates are pulled from the Evaluation branch instead of the Current branch. To change the MA policy settings, go to McAfee Agent, General, My Default, Updates.
Recommended ePO product upgrade steps for systems currently running either Host IPS 8.0 GA (8.0.0.1741) or Patch 1 (8.0.0.1919):
- Check in Host IPS 8.0 HF833271 to a designated branch of the ePO repository.
- Check in Host IPS 8.0
Patch 2 (incremental update package) to a designated branch of the ePO repository. - To configure a product update task, first review the list of selectable
Patches and Service Packs. The list is available underProducts, patches , service packs, etc. entry for Package types. - If the list includes more than one entry for Host IPS 8.0, make sure that all these entries are selected.
- If your system isn't fully updated after running the update task once, rerun it again to fully update systems with all packages. Product update tasks adhere to the following logic when updating a managed product:
- Install content updates
- Install an available hotfix update
- Install an available
patch update
The first product update task installs Hotfix 833271 and
- Configure a Daily product update task to run once per day. All packages will be deployed after 1 (or 2) successive days (or 1–2 runs of the product update task).
- Configure multiple scheduled task times for a single update task. All packages will be deployed after 1 (or 2) successive product update tasks are completed.
- Configure a product update task to repeat (we recommend 30-minute, or more, task intervals). All packages will be deployed after 2 (or 3) successive product update tasks are completed.
NOTE: We also recommend using Task Randomization in large environments to reduce high periods of bandwidth consumption.
Product Update tasks must be rerun on client systems not reporting the correct product version for
If client systems are reporting product version 8.0.0.2481 (HF833271), the Product Update tasks must be rerun on client systems to install
To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.
Version Reporting:
The Host IPS product version can be verified by running the Host IPS: Client Versions report template under ePO Queries and Reports.
The report displays the versions of Host IPS running on each client system. If a system isn't fully upgraded to Patch 2 (8.0.0.2151), the update task must be rerun on the system reporting (8.0.0.2481) to make sure that it's fully upgraded to Patch 2 (8.0.0.2151).
Hotfix Reporting
Systems will need to have reported back full properties after the installations before the most current report data is available. To query hotfix information for Host IPS and VirusScan Enterprise directly from the SQL database, see KB67406 - How to list all computers that have a specific VirusScan Enterprise or Host IPS hotfix installed.
The Host IPS product version can be verified by running the Host IPS: Client Versions report template under ePO Queries and Reports.
IMPORTANT: Systems displaying version 8.0.0.2481 applied have not successfully upgraded to Patch 2. As such, the deployment task must be run again to ensure proper upgrade to version 8.0.0.2151.
The report displays the versions of Host IPS running on each client system. If a system isn't fully upgraded to P
Hotfix Reporting
Systems will need to have reported back full properties after the installations before the most current report data is available. To query hotfix information for Host IPS and VirusScan Enterprise directly from the SQL database, see KB67406 - How to list all computers that have a specific VirusScan Enterprise or Host IPS hotfix installed.
Attachment
Affected Products
Languages:
This article is available in the following languages:
English United StatesSpanish Spain
French
Italian
Japanese
Portuguese Brasileiro
