none
Random crashes in CRYPT32.dll with latest Windows Update 1803 RRS feed

  • Question

  • Hello!

    We have a number of C# applications targeting .NET 4.6.1 and NETStandard 2.0 deployed on a customer machines and launched as services.

    We suppose that after latest Windows Update (1803) our customers started to experience crashes connected with CRYPT32.dll.

    Here's a stacktrace:

     	 	 	 	 	crypt32.dll!_guard_dispatch_icall_nop()	 
     	 	 	 	 	 	crypt32.dll!TlgAggregateInternalRegisteredProviderEtwCallback(struct _GUID const *,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR *,void *)	 
     	 	 	 	 	 	crypt32.dll!_TlgEnableCallback()	 
     	 	 	 	 	 	ntdll.dll!EtwpEventApiCallback()	 
     	 	 	 	 	 	ntdll.dll!EtwpUpdateEnableInfoAndCallback()	 
     	 	 	 	 	 	ntdll.dll!EtwpProcessNotification()	 
     	 	 	 	 	 	ntdll.dll!EtwDeliverDataBlock()	 
     	 	 	 	 	 	ntdll.dll!EtwpNotificationThread()	 
     	 	 	 	 	 	ntdll.dll!TppExecuteWaitCallback()	 
     	 	 	 	 	 	ntdll.dll!TppWorkerThread()	 
     	 	 	 	 	 	kernel32.dll!BaseThreadInitThunk()	 
     	 	 	 	 	 	ntdll.dll!RtlUserThreadStart()	 

    Here's a log message:

    ​Faulting application name: <skipped>, version: 15.5.10244.4, time stamp: 0x5ab270fa
    Faulting module name: CRYPT32.dll, version: 10.0.17134.1, time stamp: 0x01d34162
    Exception code: 0xc0000005
    Fault offset: 0x00000000000621f0
    Faulting process ID: 0x195c
    Faulting application start time: 0x01d3ec5e2bbb7868
    Faulting application path: <skipped>
    Faulting module path: C:\WINDOWS\System32\CRYPT32.dll
    Report ID: f45010dd-2d60-457e-8564-92af9b59619a
    Faulting package full name: 
    Faulting package-relative application ID: 

    Do you have any ideas what it can be?

    Thanks!



    Monday, June 11, 2018 9:26 AM

All replies

  • Hi Nikolai Orekhov,

    Thank you for posting here.

    According to your stacktrace and log message, there is no useful message about crash.

    Could you provide the dump file when random crashes in CRYPT32.dll?

    Here is the link about how to create a dump file for your reference.

    https://msdn.microsoft.com/en-us/library/d5zhxt22.aspx?f=255&MSPPError=-2147217396#Create%20a%20dump%20file

    Best Regards,

    Wendy


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Wednesday, June 13, 2018 2:42 AM
    Moderator
  • The dump contains sensitive information. Is there a way we can privately send it to you?
    Wednesday, June 13, 2018 7:14 AM
  • Hi Nikolai Orekhov,

    Thank you for feedback.

    Sorry for that. You could upload on OneDrive.

    According to our policy, we could not provide any personal contact information. You could provide some details without sensitive information. 

    Best Regards,

    Wendy


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Monday, June 18, 2018 8:43 AM
    Moderator
  • Cross-posting my response from another thread about, I think, the exact same issue:

    I am experiencing a similar issue with .NET 2.0 and 4.6 builds (both 32- and 64-bit) of an application on Ultimate 1803 64-bit (and there were no issues on 1709). I found out that as a workaround you can use imagecfg.exe with the -u argument to restrict the application to run on a single logical CPU.

    I am suspecting a non-locked non-atomic pointer assignment happening somewhere in mscorlib.dll and crypt32.dll and the one that dereferences the pointer in question crashes.

    Thursday, June 21, 2018 7:36 PM
  • I got the same problem with an program running, here are some Event Viewer errors:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Application Error" /> 
      <EventID Qualifiers="0">1000</EventID> 
      <Level>2</Level> 
      <Task>100</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2018-07-25T07:03:49.338578300Z" /> 
      <EventRecordID>9759</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>WESTOR-PC</Computer> 
      <Security /> 
      </System>
    - <EventData>
      <Data>AdiIRC.exe</Data> 
      <Data>3.2.0.0</Data> 
      <Data>49d87c18</Data> 
      <Data>CRYPT32.dll</Data> 
      <Data>10.0.17134.1</Data> 
      <Data>01d34162</Data> 
      <Data>c0000005</Data> 
      <Data>00000000000621f0</Data> 
      <Data>834</Data> 
      <Data>01d423e38de19fc0</Data> 
      <Data>C:\Users\westo\Documents\AdIIRC\AdiIRC.exe</Data> 
      <Data>C:\WINDOWS\System32\CRYPT32.dll</Data> 
      <Data>463c3eb8-a0de-42e9-b1e7-d5231ba08a74</Data> 
      <Data /> 
      <Data /> 
      </EventData>
      </Event>
    
    -------------------------------------------------------
    
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Application Error" /> 
      <EventID Qualifiers="0">1000</EventID> 
      <Level>2</Level> 
      <Task>100</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2018-07-18T07:56:18.306112700Z" /> 
      <EventRecordID>8858</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>WESTOR-PC</Computer> 
      <Security /> 
      </System>
    - <EventData>
      <Data>AdiIRC.exe</Data> 
      <Data>3.2.0.0</Data> 
      <Data>49d87c18</Data> 
      <Data>QUARTZ.dll</Data> 
      <Data>10.0.17134.1</Data> 
      <Data>73abbbe6</Data> 
      <Data>c0000005</Data> 
      <Data>000000000004223e</Data> 
      <Data>229c</Data> 
      <Data>01d41e181a47815e</Data> 
      <Data>C:\Users\westo\Documents\AdIIRC\AdiIRC.exe</Data> 
      <Data>C:\WINDOWS\SYSTEM32\QUARTZ.dll</Data> 
      <Data>05c27898-709c-4aad-aee8-79cac7f9685c</Data> 
      <Data /> 
      <Data /> 
      </EventData>
      </Event>
    
    -------------------------------------------------------------------
    
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Application Error" /> 
      <EventID Qualifiers="0">1000</EventID> 
      <Level>2</Level> 
      <Task>100</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2018-07-14T14:21:52.245543100Z" /> 
      <EventRecordID>8418</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>WESTOR-PC</Computer> 
      <Security /> 
      </System>
    - <EventData>
      <Data>AdiIRC.exe</Data> 
      <Data>3.2.0.0</Data> 
      <Data>49d87c18</Data> 
      <Data>CRYPT32.dll</Data> 
      <Data>10.0.17134.1</Data> 
      <Data>01d34162</Data> 
      <Data>c0000005</Data> 
      <Data>00000000000621f0</Data> 
      <Data>584</Data> 
      <Data>01d41a09a3a4b732</Data> 
      <Data>C:\Users\westo\Documents\AdIIRC\AdiIRC.exe</Data> 
      <Data>C:\WINDOWS\System32\CRYPT32.dll</Data> 
      <Data>33b60ab6-0fc9-4bae-8823-e87d0df88e88</Data> 
      <Data /> 
      <Data /> 
      </EventData>
      </Event>

    Wednesday, July 25, 2018 12:49 PM
  • Hi,

    I'm seeing the same issue with a C++ program based on SChannel... the stack trace:

    crypt32.dll!_guard_dispatch_icall_nop�()	Unknown
    crypt32.dll!TlgAggregateInternalRegisteredProviderEtwCallback(struct _GUID const *,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR *,void *)	Unknown
    crypt32.dll!_TlgEnableCallback()	Unknown
    ntdll.dll!EtwpEventApiCallback()	Unknown
    ntdll.dll!EtwpUpdateEnableInfoAndCallback()	Unknown
    ntdll.dll!EtwpSetProviderTraits()	Unknown
    crypt32.dll!TraceLoggingRegisterEx()	Unknown
    crypt32.dll!TlgRegisterAggregateProviderEx�()	Unknown
    crypt32.dll!I_PFXDecrypt�()	Unknown
    crypt32.dll!Decrypt_Private_Key(struct _CRYPT_ALGORITHM_IDENTIFIER,struct _CRYPTOAPI_BLOB,unsigned char *,unsigned long *,void *)	Unknown
    crypt32.dll!CryptImportPKCS8�()	Unknown
    crypt32.dll!ImportCAPIKey()	Unknown
    crypt32.dll!CertImportSafeContents()	Unknown
    crypt32.dll!I_PFXImportCertStoreEx()	Unknown
    crypt32.dll!PFXImportCertStore�()	Unknown
    icessl37.dll!IceSSL::SChannel::SSLEngine::initialize() Line 783	C++
    ice37.dll!Ice::PluginManagerI::initializePlugins() Line 89	C++
    ice37.dll!IceInternal::Instance::finishSetup(int & argc, const char * * argv, const IceInternal::Handle<Ice::Communicator> & communicator) Line 1550	C++
    ice37.dll!Ice::CommunicatorI::finishSetup(int & argc, const char * * argv) Line 565	C++
    ice37.dll!Ice::initialize(const Ice::InitializationData & initData, int version) Line 354	C++
    client.exe!StressClient::run() Line 192	C++
    ice37.dll!startHook(void * arg) Line 411	C++
    [External Code]	

    It's possible other threads are also calling SChannel APIs. Aren't SChannel APIs thread safe?

    Cheers,

    Benoit.

    Wednesday, October 10, 2018 3:27 PM
  • Exact same problem:

    Faulting application name: XXX.exe, version: 1.0.0.0, time stamp: 0x5bb3d194
    Faulting module name: CRYPT32.dll, version: 10.0.17134.1, time stamp: 0x01d34162
    Exception code: 0xc0000005
    Fault offset: 0x00000000000621f0
    Faulting process id: 0x14c0
    Faulting application start time: 0x01d45b26d2210ea1
    Faulting application path: C:\Program Files\XXX
    Faulting module path: C:\WINDOWS\System32\CRYPT32.dll
    Report Id: 2614cb12-1c5e-4eb2-962e-c17839eafb51
    Faulting package full name:
    Faulting package-relative application ID: 

    I can't reduce the service to use only one thread, it's running heavy processing. Any other workaround ? Any fix coming ?

    Thursday, October 11, 2018 12:24 AM