Weird memory dump instead of actual requested data on package download

[wechselberg.nisboerge_3629]

Hi,

some really weird behaviour, but quite worrying:

In a few random download cases, instead of the requested data, we are getting data that looks like a piece of the process memory.

In one observed case, we received this bit of data instead of the actual requested package (librados2-perl debian package)

Any idea why that is happening? This doesn't look comforting in a security sense.

Sadly, I don't have any concrete hints on how to reproduce this.

[stevedennis]

Hi @wechselberg-nisboerge_3629,

I'm not sure what I'm looking at in the screenshot, but it's most certainly not a piece of process memory. Based on the string literal, it's likely a compiled library (i.e. DLL) that's invoking methods in that system library; you'd need to study the contents in a hex view look for executable headers if you really wanted to know.

Anyway, when it comes to downloading files, those are streamed directly from disk. In every instance of "corrupt downloads" that we've encountered, it was either due to network errors or hardware failures. And those are equally "impossible" to reproduce and nearly impossible to detect.

I would just try new hardware, that usually does the trick. We see this quite a bit in cloud environments (Azure mostly, but every now and then AWS and GCP).

Thanks,
Steve