- The WAD daemon crashes after upgrading FortiOS to be v7.0.9 build0444.
When configuring VIP settings on a FortiGate unit and the traffic passes through the VIP policy, it causes FortiGate’s memory corruption.
-
Run CLI command and it shows the logs as below.
diagnose debug crashlog read
5073: 2025-06-24 15:39:45 <00716> firmware FortiGate-3200D v7.0.9,build0444b0444,221121 (GA.M) (Release)
5074: 2025-06-24 15:39:45 <00716> application wad
5075: 2025-06-24 15:39:45 <00716> *** signal 11 (Segmentation fault) received ***
5076: 2025-06-24 15:39:45 <00716> AVDB 90.09746(01/17/0023 21:26)
5077: 2025-06-24 15:39:45 <00716> ETDB 90.09746(01/17/0023 21:25)
5078: 2025-06-24 15:39:45 <00716> AVSO 04000000AVEN00701062822209152232
5079: 2025-06-24 15:39:45 <00716> Register dump:
5080: 2025-06-24 15:39:45 <00716> RAX: 00007f5a50cd62f8 RBX: 0000000000000010
5081: 2025-06-24 15:39:45 <00716> RCX: 0000000000000000 RDX: 0000000000000010
5082: 2025-06-24 15:39:45 <00716> R08: 0000000000000000 R09: 0000000000000000
5083: 2025-06-24 15:39:45 <00716> R10: 00007f5a510420a8 R11: 0000000000000246
5084: 2025-06-24 15:39:45 <00716> R12: 00007f5aa9a9a048 R13: 00007f5a50cd6230
5085: 2025-06-24 15:39:45 <00716> R14: 00007f5a51041ea8 R15: 00007f5a510420a8
5086: 2025-06-24 15:39:45 <00716> RSI: 00007f5a50cd6240 RDI: 0000000000000008
5087: 2025-06-24 15:39:45 <00716> RBP: 00007fff0c24b4e0 RSP: 00007fff0c24b4b0
5088: 2025-06-24 15:39:45 <00716> RIP: 0000000001ab07b8 EFLAGS: 0000000000010293
5089: 2025-06-24 15:39:45 <00716> CS: 0033 FS: 0000 GS: 0000
5090: 2025-06-24 15:39:45 <00716> Trap: 000000000000000e Error: 0000000000000004
5091: 2025-06-24 15:39:45 <00716> OldMask: 0000000000000000
5092: 2025-06-24 15:39:45 <00716> CR2: 0000000000000028
5093: 2025-06-24 15:39:45 <00716> stack: 0x7fff0c24b4b0 - 0x7fff0c24b850
5094: 2025-06-24 15:39:45 <00716> Backtrace:
5095: 2025-06-24 15:39:45 <00716> [0x01ab07b8] => /bin/wad
5096: 2025-06-24 15:39:45 <00716> [0x01aaea63] => /bin/wad
5097: 2025-06-24 15:39:45 <00716> [0x01aaea63] => /bin/wad
5098: 2025-06-24 15:39:45 <00716> [0x01bbb850] => /bin/wad
5099: 2025-06-24 15:39:45 <00716> [0x01bec806] => /bin/wad
5100: 2025-06-24 15:39:45 <00716> [0x01b661ce] => /bin/wad
5101: 2025-06-24 15:39:45 <00716> [0x01b664b7] => /bin/wad
5102: 2025-06-24 15:39:45 <00716> [0x01c06796] => /bin/wad
5103: 2025-06-24 15:39:45 <00716> [0x0044c697] => /bin/wad
5104: 2025-06-24 15:39:45 <00716> [0x7f5ac66fddeb] => /usr/lib/x86_64-linux-gnu/libc.so.6 => n/a => ??:0
5105: 2025-06-24 15:39:45 (__libc_start_main+0x000000eb) liboffset 00023deb
5106: 2025-06-24 15:39:45 <00716> [0x00447e1a] => /bin/wad
5107: 2025-06-24 15:39:45 <00716> fortidev 6.0.1.0005
5108: 2025-06-24 15:39:45 <00716> process=wad type=2 idx=12 av-scanning=no total=64466 free=44989
5109: 2025-06-24 15:39:45 mmu=9015663 mu=6067355 m=3771987 f=3727837 r=0
5110: 2025-06-24 15:39:45 <00716> cur_bank=(nil) curl_tl=0xc1101e0 curl_tm=0x7f5aa9681190
5111: 2025-06-24 15:39:45 <00716> (session info) vf=4 session-id=128024539 app_type=1 dyn_type=0
5112: 2025-06-24 15:39:45 non_tp=0, pol_id=4161, h2=0, src/port=172.24.15.5:47190, dst/port=172.24.15.117
5113: 2025-06-24 15:39:45 :80, usr/grp=(/)
5114: 2025-06-24 15:39:45 [AV Engine <716>] AV Engine version: 6.4.282
5115: 2025-06-24 15:39:45 [AV Engine <716>] Last file info:
5116: 2025-06-24 15:39:45 [AV Engine <716>] filename: , filesize: 0, filebuffer: (nil)
5117: 2025-06-24 15:39:45 [AV Engine <716>] Native script imagebase: 0x7f5aa9af0000
5118: 2025-06-24 15:39:45 [AV Engine <716>] Native script imagesize: 0x9000
5119: 2025-06-24 15:39:45 [AV Engine <716>] AV Engine imagebase: 0x7f5aa8f43000
5120: 2025-06-24 16:39:45 wad crashed 1 times. The latest crash was at 2025-06-24 15:39:45.
For a permanent fix, it is necessary to upgrade the FortiGate firmware version to v7.4.8, v7.6.3, and above.
|
