Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-154295

Memory leaks in verifier push-mode implementation

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • None
    • None
    • rhel-security-special-projects
    • ZStream
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • Regression Exception
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      The verifier's push-mode attestation flow has memory leaks that cause unbounded memory growth over time, eventually leading to OOM conditions in long-running deployments.

      *Observed Behavior:*

      • Verifier memory usage grows linearly over time and never plateaus
      • Garbage collection is unable to reclaim attestation-related objects between cycles
      • Memory growth is visible within minutes when using larger policies

      *Reproduction:*
      1. Start a verifier with push-mode enabled
      2. Register a single agent
      3. Enroll the agent using a policy generated with `keylime-policy --rootfs /` (creates ~5-6MB policy on a 1mt testing system; size may vary depending on the system)
      4. Let attestation cycles run for several minutes
      5. Monitor verifier memory usage
      6. Observe linear memory growth

      *Impact:*
      This affects all long-running verifier deployments using push-mode (7.14+). The memory leak causes service degradation and eventual crashes, requiring periodic restarts to maintain stability.

              scorreia@redhat.com Sergio Correia
              scorreia@redhat.com Sergio Correia
              Sergio Correia Sergio Correia
              Karel Srot Karel Srot
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: