Describe the bug
Falco's gVisor engine (engine.kind=gvisor) crashes with a bare Error: vector (no stack trace) the first time a freshly started Falco process receives any real event, reproduced with both container-start events and exec events fired against an already-running container. Reproduced with 100% consistency across repeated tests (18/18 in one batch), on two independent machines.
Root cause
userspace/libscap/engine/gvisor/parsers.cpp, in parse_container_start(): gvisor_evt.args(0) is read without first checking gvisor_evt.args_size() > 0. When the incoming Start message has an empty args list, this is an out-of-bounds access on a protobuf repeated field, which is a GOOGLE_DCHECK-guarded check that compiles to a no-op in release builds, producing undefined behavior rather than a catchable exception, consistent with the bare, stack-trace-free crash observed.
To reproduce
Configure engine.kind=gvisor per the standard pod-init.json / runsc install --runtime=runsc-falco -- --pod-init-config=... setup. Start Falco. Start any container under that runtime, or exec into an already-running one. Falco crashes immediately.
Expected behavior
The engine should handle an empty args list gracefully rather than crashing.
Proposed fix
std::string exe, comm;
if (gvisor_evt.args_size() > 0) {
exe = gvisor_evt.args(0).c_str();
} else {
exe = "";
}
Environment
Falco 0.42.1, libs 0.22.2, reproduced on Ubuntu 24.04 (two separate machines).
Note
Understood this engine is deprecated and removed as of 0.44.0, filing for the record in case this affects anyone still on a pre-0.44 pin, or in case a similar unguarded pattern exists elsewhere in this file (a related crash was also observed on exec events, which this specific function shouldn't handle, suggesting a second, similar issue not yet located).
Describe the bug
Falco's gVisor engine (engine.kind=gvisor) crashes with a bare Error: vector (no stack trace) the first time a freshly started Falco process receives any real event, reproduced with both container-start events and exec events fired against an already-running container. Reproduced with 100% consistency across repeated tests (18/18 in one batch), on two independent machines.
Root cause
userspace/libscap/engine/gvisor/parsers.cpp, in parse_container_start(): gvisor_evt.args(0) is read without first checking gvisor_evt.args_size() > 0. When the incoming Start message has an empty args list, this is an out-of-bounds access on a protobuf repeated field, which is a GOOGLE_DCHECK-guarded check that compiles to a no-op in release builds, producing undefined behavior rather than a catchable exception, consistent with the bare, stack-trace-free crash observed.
To reproduce
Configure engine.kind=gvisor per the standard pod-init.json / runsc install --runtime=runsc-falco -- --pod-init-config=... setup. Start Falco. Start any container under that runtime, or exec into an already-running one. Falco crashes immediately.
Expected behavior
The engine should handle an empty args list gracefully rather than crashing.
Proposed fix
Environment
Falco 0.42.1, libs 0.22.2, reproduced on Ubuntu 24.04 (two separate machines).
Note
Understood this engine is deprecated and removed as of 0.44.0, filing for the record in case this affects anyone still on a pre-0.44 pin, or in case a similar unguarded pattern exists elsewhere in this file (a related crash was also observed on exec events, which this specific function shouldn't handle, suggesting a second, similar issue not yet located).