System crash (blue screen) Bugcheck 50 with VirusScan Enterprise 8.8 Patch 4

Technical Articles ID: KB81529
Last Modified: 1/23/2020

Environment

McAfee VirusScan Enterprise (VSE) 8.8 Patch 4

For details of VSE 8.x supported environments, see KB51111.

Summary

Some customers have reported this issue on server class systems that fail at unpredictable times. It occurs when VSE is performing much scan activity (file activities).

The server class systems include a build server for a development environment and Citrix servers, because they provide files to numerous users concurrently. The risk of experiencing the failure is undetermined, but is higher for busier systems.

Problem

Random Bugcheck 50 system crash (blue screen) on server class systems.

The stack of the crashing thread indicates a call to nt!PsGetProcessId before failing.

Example stack text from a 64-bit system:

STACK_TEXT:
fffff880`06f8ce28 fffff800`01f46bf0 : 00000000`00000050 fffffa80`15205cb0 00000000`00000000 fffff880`06f8cf90 : nt!KeBugCheckEx
fffff880`06f8ce30 fffff800`01ec6cee : 00000000`00000000 fffffa80`15205cb0 00000000`00000000 00000000`00000001 : nt!wcsncat_s+0x2d7f8
fffff880`06f8cf90 fffff800`01e930f0 : fffff880`04478c10 00000000`00000005 00000000`00000001 fffff880`044ab140 : nt!KeSynchronizeExecution+0x28be
fffff880`06f8d128 fffff880`04478c10 : 00000000`00000005 00000000`00000001 fffff880`044ab140 fffff880`044ab140 : nt!PsGetProcessId
fffff880`06f8d130 fffff880`04471951 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`106c2c90 : mfeavfk+0xec10
fffff880`06f8d2e0 fffff880`04473501 : fffffa80`13d07160 00000000`00000000 fffffa80`106c2d70 fffffa80`106c2dc8 : mfeavfk+0x7951
fffff880`06f8d380 fffff880`0151f94f : 00000000`00000000 00000000`00000000 fffffa80`10ef8f20 00000000`00100021 : mfeavfk+0x9501
fffff880`06f8d3b0 fffff880`015560a7 : fffffa80`106c2c90 00000000`00000000 00000000`00000000 fffffa80`11138db0 : mfehidk+0x2b94f
fffff880`06f8d3e0 fffff880`01272288 : fffffa80`1f155fb8 00000000`00000000 fffffa80`1f155fb8 00000000`00000000 : mfehidk+0x620a7
fffff880`06f8d410 fffff880`01270d1b : fffffa80`1d004c40 fffffa80`11138f00 fffffa80`1c4379f0 fffffa80`1c437c10 : fltmgr!FltIsCallbackDataDirty+0x1998
fffff880`06f8d4e0 fffff880`012902b9 : fffffa80`1f155cf0 fffffa80`1c537800 fffffa80`1f155c00 fffffa80`1c3c3de0 : fltmgr!FltIsCallbackDataDirty+0x42b
fffff880`06f8d570 fffff800`021c843c : 00000000`00000005 fffffa80`1e46bcc8 fffffa80`10ef8f20 00000000`00000000 : fltmgr!FltReadFile+0x10379
fffff880`06f8d620 fffff800`021c3db8 : fffffa80`1c3af9d0 fffff800`00000000 fffffa80`1e46bb10 fffffa80`00000001 : nt!MmCreateSection+0x279c
fffff880`06f8d780 fffff800`021c4fd6 : 00000000`00000000 fffffa80`1e46bb10 fffff880`06f8d890 fffffa80`0cdacf30 : nt!SeQueryInformationToken+0xc48
fffff880`06f8d870 fffff800`021c68dc : 00000000`00000000 00000000`00000000 00000000`00000001 ffffffff`ffffffff : nt!ObOpenObjectByName+0x306
fffff880`06f8d940 fffff800`021b0ed8 : 00000000`015de380 00000000`00100021 00000000`015de438 00000000`015de468 : nt!MmCreateSection+0xc3c
fffff880`06f8d9e0 fffff800`01ec7e53 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtOpenFile+0x58
fffff880`06f8da70 00000000`775c15ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a23

System Change

Either of the following products that use the driver version 15.1.0.656 were installed:

VSE 8.8 Patch 4
Host Intrusion Prevention 8.0 Patch 4

Cause

Multiple threads can update a data structure used for scanning. But, the data structure is updated without the requisite guards in place to guarantee the state of the data. The failure occurs when a thread uses the data and the content is unexpected.

Solution

This issue was resolved in VSE 8.8 patch 5.

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.

Updates are available when you log on to the ServicePortal.

Affected Products

Known Issue/Product Defect
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

System crash (blue screen) Bugcheck 50 with VirusScan Enterprise 8.8 Patch 4

Environment

Summary

Problem

System Change

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

System crash (blue screen) Bugcheck 50 with VirusScan Enterprise 8.8 Patch 4

Environment

Summary

Problem

System Change

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title