-
Bug
-
Resolution: Unresolved
-
Critical
-
rhel-10.2
-
None
-
None
-
rhel-security-special-projects
-
ZStream
-
None
-
False
-
False
-
-
None
-
None
-
Regression Exception
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
The verifier's push-mode attestation flow has memory leaks that cause unbounded memory growth over time, eventually leading to OOM conditions in long-running deployments.
*Observed Behavior:*
- Verifier memory usage grows linearly over time and never plateaus
- Garbage collection is unable to reclaim attestation-related objects between cycles
- Memory growth is visible within minutes when using larger policies
*Reproduction:*
1. Start a verifier with push-mode enabled
2. Register a single agent
3. Enroll the agent using a policy generated with `keylime-policy --rootfs /` (creates ~5-6MB policy on a 1mt testing system; size may vary depending on the system)
4. Let attestation cycles run for several minutes
5. Monitor verifier memory usage
6. Observe linear memory growth
*Impact:*
This affects all long-running verifier deployments using push-mode (7.14+). The memory leak causes service degradation and eventual crashes, requiring periodic restarts to maintain stability.