bug: Image scanning panics when using certain combination of options #6613
Labels
kind/bug
Categorizes issue or PR as related to a bug.
scan/license
Issues relating to license scanning
Comments
simar7
added
kind/bug
|
cc @DmitriyLewen does license scanner do anything special with the DB? I haven't investigated but the panic stack trace looks interesting. |
|
Thanks guys. If there's anything I can do to help let me know #ExAquarian #askKevBeedle |
|
Hello @simar7 , @psg18dhc trivy/pkg/commands/artifact/run.go Lines 547 to 552 in 770b141 I will create a PR to disable the option to change scanners (with notification). |
6 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Discussed in #6610
Originally posted by psg18dhc May 2, 2024
Description
When trying to scan a container image on the ClI with 0.50. i cannot combine these cli parameters as it crashes. - when combined with --compliance docker-cis
trivy image $Registry/$ImageName --compliance docker-cis --scanners misconfig --scanners license
Desired Behavior
Expect trivy to scan for misconfiguration and oss licences together
Actual Behavior
Scanning docker.io/alpine:latest using Vulns, Secret Scanning, CIS Compliance and Misconfigurations
2024-05-02T17:25:20.519+0100 INFO Container image config scanners: ["misconfig" "secret"]
2024-05-02T17:25:20.519+0100 INFO Vulnerability scanning is enabled
2024-05-02T17:25:20.519+0100 INFO Misconfiguration scanning is enabled
2024-05-02T17:25:20.682+0100 INFO Detected OS: alpine
2024-05-02T17:25:20.683+0100 INFO Detecting Alpine vulnerabilities...
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x1c0 pc=0x4cd23cd]
goroutine 1 [running]:
go.etcd.io/bbolt.(*DB).beginTx(0x0)
/home/runner/go/pkg/mod/go.etcd.io/[email protected]/db.go:730 +0x2d
go.etcd.io/bbolt.(*DB).Begin(0xc001cdf680?, 0xa0?)
/home/runner/go/pkg/mod/go.etcd.io/[email protected]/db.go:723 +0x25
go.etcd.io/bbolt.(*DB).View(0x20?, 0xc003c6ce68)
/home/runner/go/pkg/mod/go.etcd.io/[email protected]/db.go:901 +0x30
github.com/aquasecurity/trivy-db/pkg/db.Config.forEach({}, {0xc003275880?, 0x2, 0x2})
/home/runner/go/pkg/mod/github.com/aquasecurity/[email protected]/pkg/db/db.go:186 +0xe5
github.com/aquasecurity/trivy-db/pkg/db.Config.ForEachAdvisory(...)
/home/runner/go/pkg/mod/github.com/aquasecurity/[email protected]/pkg/db/advisory.go:20
github.com/aquasecurity/trivy-db/pkg/db.Config.GetAdvisories({}, {0xc000bf4d10, 0xb}, {0xc000de1bc0, 0x11})
/home/runner/go/pkg/mod/github.com/aquasecurity/[email protected]/pkg/db/advisory.go:24 +0xd9
github.com/aquasecurity/trivy-db/pkg/vulnsrc/alpine.VulnSrc.Get({{0x96300a8?, 0xcc9a940?}}, {0xc000bf4c9c?, 0xc00274e000?}, {0xc000de1bc0, 0x11})
/home/runner/go/pkg/mod/github.com/aquasecurity/[email protected]/pkg/vulnsrc/alpine/alpine.go:119 +0xa7
github.com/aquasecurity/trivy/pkg/detector/ospkg/alpine.(*Scanner).Detect(0xc0017c03a0, {0xc00033a006, 0x6}, 0xc00033a000?, {0xc001e78000, 0xf, 0xc00274e000?})
/home/runner/work/trivy/trivy/pkg/detector/ospkg/alpine/alpine.go:91 +0x478
github.com/aquasecurity/trivy/pkg/detector/ospkg.Detect({0x96073f0, 0xc00133c770}, {0x0?, 0x3afe?}, {0xc00033a000, 0x6}, {0xc00033a006, 0x6}, 0xc001e70120?, {0x0, ...}, ...)
/home/runner/work/trivy/trivy/pkg/detector/ospkg/detect.go:76 +0xfb
github.com/aquasecurity/trivy/pkg/scanner/ospkg.(*scanner).Scan(, {, }, {{0x7ffdcb2be0c6, 0x17}, {{0xc00033a000, 0x6}, {0xc00033a006, 0x6}, 0x0, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/scanner/ospkg/scan.go:54 +0x17d
github.com/aquasecurity/trivy/pkg/scanner/local.Scanner.scanVulnerabilities({{, }, {, }, {, }, {{, }}}, {0x96073f0, 0xc00133c770}, ...)
/home/runner/work/trivy/trivy/pkg/scanner/local/scan.go:176 +0x165
github.com/aquasecurity/trivy/pkg/scanner/local.Scanner.ScanTarget({{, }, {, }, {, }, {{, }}}, {0x96073f0, 0xc00133c770}, ...)
/home/runner/work/trivy/trivy/pkg/scanner/local/scan.go:124 +0x51e
github.com/aquasecurity/trivy/pkg/scanner/local.Scanner.Scan({{0x9558e20, 0xc00391ecf0}, {0x9579f20, 0xcc9a940}, {, }, {{, }}}, {0x96073f0, 0xc00133c770}, ...)
/home/runner/work/trivy/trivy/pkg/scanner/local/scan.go:101 +0xcbe
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{, }, {, }}, {, }, {{0xc003274560, 0x2, 0x2}, {0xc00391ea80, ...}, ...})
/home/runner/work/trivy/trivy/pkg/scanner/scan.go:156 +0x2d7
github.com/aquasecurity/trivy/pkg/commands/artifact.scan({, }, {{{0x7f7f64c, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0xc00335d340, ...}, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:708 +0x397
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(, {, }, {{{0x7f7f64c, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:267 +0xac
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanImage(, {, }, {{{0x7f7f64c, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:187 +0x134
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({, _}, {{{0x7f7f64c, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0xc00335d340, ...}, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:424 +0xbad
github.com/aquasecurity/trivy/pkg/commands.NewImageCommand.func2(0xc000005200, {0xc00132e310?, 0x1?, 0x7?})
/home/runner/work/trivy/trivy/pkg/commands/app.go:307 +0xf2
github.com/spf13/cobra.(*Command).execute(0xc000005200, {0xc00132e2a0, 0x7, 0x7})
/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:983 +0xabc
github.com/spf13/cobra.(*Command).ExecuteC(0xc000004f00)
/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1115 +0x3ff
github.com/spf13/cobra.(*Command).Execute(0x7fe77d0?)
/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1039 +0x13
main.run()
/home/runner/work/trivy/trivy/cmd/trivy/main.go:35 +0x198
main.main()
/home/runner/work/trivy/trivy/cmd/trivy/main.go:17 +0x13
Reproduction Steps
Target
Container Image
Scanner
License
Output Format
Table
Mode
Standalone
Debug Output
Operating System
Linux centos.8
Version
Checklist
trivy image --resetThe text was updated successfully, but these errors were encountered: