Segfault in config mode on Mac (arm64) but works fine in CI (amd64)

[victorazzam]

Description

A segmentation violation (SIGSEGV) occurred when scanning for Terraform misconfigurations. This only occurs on my machine (arm64), but in a CI environment (amd64) it runs fine. I am not at liberty to provide more context about the CI build.

Desired Behavior

It should perform the scan normally.

Actual Behavior

Segfaulted.

Reproduction Steps

trivy config --tf-vars config.tfvars --format json --output output.json .

Target

FileSystem

Scanner

Misconfiguration

Output Format

JSON

Mode

Standalone

Debug Output

# omitted confidential information printed by the --debug flag

2024-06-20T13:07:25+02:00	INFO	Misconfiguration scanning is enabled
2024-06-20T13:07:25+02:00	INFO	Need to update the built-in policies
2024-06-20T13:07:25+02:00	INFO	Downloading the built-in policies...
53.79 KiB / 53.79 KiB [--------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s 100ms
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1071ae3dc]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x0, {0x10b9a9290, 0x14001259340})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:125 +0x2c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0x140081b0000, {0x10b9a9290, 0x14001259340})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/parser.go:270 +0x64
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x14004024000, {0x10b9a9290, 0x14001259340}, {0x10b8f57a0, 0x140044559c8}, {0x10a3d9978, 0x1})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/scanner.go:199 +0x4a0
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x140028e28a0, {0x10b9a9290, 0x14001259340}, {0x10b8f57a0?, 0x14002e0dae8?})
	github.com/aquasecurity/trivy/pkg/misconf/scanner.go:158 +0x1bc
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x14000340420, {0x10b9a9290?, 0x14001259340?}, {{0x10b8f57a0?, 0x14002e0dae8?}, {0x9?, 0x0?}})
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/config/config.go:45 +0x38
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x14002e525b0, {0x14003cdc1c0, 0x3, 0x4}, {0x1400401a400, 0x8, 0x8}, 0x14002846e40}, {0x10b9a9290, 0x14001259340}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:493 +0x228
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16d79b796, 0x3}, {0x1355749c0, 0x140029db710}, {0x10b8f56e0, 0x10fa62ee8}, {0x14002e525b0, {0x14003cdc1c0, 0x3, 0x4}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/artifact/local/fs.go:120 +0x37c
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x140029db650, ...}, ...})
	github.com/aquasecurity/trivy/pkg/scanner/scan.go:146 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.scan({_, _}, {{{0x108c0ed8b, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0x1400251dda0, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:691 +0x320
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x108c0ed8b, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:264 +0xa8
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x108c0ed8b, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:212 +0xac
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x108c0ed8b, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:192 +0x1b8
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x108c0ed8b, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0x1400251dda0, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:425 +0x408
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x14001d1c908, {0x14001258e00, 0x1, 0x7})
	github.com/aquasecurity/trivy/pkg/commands/app.go:704 +0x294
github.com/spf13/cobra.(*Command).execute(0x14001d1c908, {0x14001258d90, 0x7, 0x7})
	github.com/spf13/[email protected]/command.go:983 +0x840
github.com/spf13/cobra.(*Command).ExecuteC(0x14000b11b08)
	github.com/spf13/[email protected]/command.go:1115 +0x344
github.com/spf13/cobra.(*Command).Execute(0x108c7c84d?)
	github.com/spf13/[email protected]/command.go:1039 +0x1c
main.run()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:39 +0x120
main.main()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:19 +0x20

Operating System

macOS Sonoma 14.5

Version

Version: 0.52.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-06-13 12:13:22.596772287 +0000 UTC
  NextUpdate: 2024-06-13 18:13:22.596771977 +0000 UTC
  DownloadedAt: 2024-06-13 13:01:28.202447 +0000 UTC
Check Bundle:
  Digest: sha256:cfb65621a1f55d9d099c4c28931b252716fcda8bba5081eb43f1001668e79d85
  DownloadedAt: 2024-06-20 08:43:01.031331 +0000 UTC

Checklist

• Read the troubleshooting
• Run trivy image --reset

[nikpivkin]

Hi @victorazzam ! Could you provide a minimally reproducible example?

[victorazzam]

I could not deduce enough to reproduce this behavior outside of my environment. Adding --debug just lists parsed files akin to:

...
2024-06-20...   DEBUG   [misconf] 28:11.724685000 terraform.parser.<root>   Parsing 'path/to/something.tf'
...
... Evaluating module...
... Read 18 block(s) and 0 ignore(s) for module 'root' (9 file[s])...
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1057c23dc]

Perhaps a missing nil check?

[nikpivkin]

github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:125 +0x2c

There is nothing in this line that could cause a panic. Does this happen all the time on your machine, or did it only happen 1 time? Do you have Trivy version 0.52.2 installed on your machine?

[victorazzam]

Yep, the full version info is pasted above. FWIW I figured out when the problem arises:

• When --tf-vars is used, it segfaults, even if followed by a directory or a completely made-up path.
• When the flag is not used, it times out:

Fatal error: filesystem scan error: scan error: scan failed: failed analysis: post analysis error: post analysis error: cloudformation scan error: scan config error: context deadline exceeded

[simar7]

When --tf-vars is used, it segfaults, even if followed by a directory or a completely made-up path.

You are right, I was able to reproduce this. I'll create an issue to track this: #7084

When the flag is not used, it times out:
Fatal error: filesystem scan error: scan error: scan failed: failed analysis: post analysis error: post analysis error: cloudformation scan error: scan config error: context deadline exceeded

This seems to be a separate issue of it its own. Are you able to give us a more details as to how your input being scanned looks like? Maybe you have a lot of files and Trivy isn't able to scan them in timeout deadline it has by default.