search

microsoft / AttackSurfaceAnalyzer

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.
MIT License
2.68k stars 271 forks source link

Out of Memory Error during Analysis Step #713

Open ausetiad opened 3 months ago

ausetiad commented 3 months ago

Describe the bug A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behavior:

  1. Using CLI, perform baseline scan and another scan - "./Asa collect -CdlfFkpPsuwh —runid" (following instructions here https://github.com/microsoft/AttackSurfaceAnalyzer/wiki/CLI-Walkthrough)
  2. Run "asa export-collect --outputsarif"
  3. See error: "Out of memory. zsh: abort ./Asa export-collect --outputsarif --lowmemoryusage"

Expected behavior I expect the analysis to be performed as explained in the walkthroug

Screenshots If applicable, add screenshots to help explain your problem. image

System Configuration (please complete the following information):

Additional Context

gfs commented 3 months ago

Thanks for the report. I'll try to reproduce this and see if there's anything that can be done to reduce memory during the analysis step.

To give me some hints about how to best repro this. Can you share how much memory your system has, how large the total asa.sqlite dbs you've collected are and, if you know, how much memory is being consumed when you hit the out of memory error?

ausetiad commented 3 months ago

@gfs

Machine is a 2023 Mac Studio, Apple M2 Max chip with 32GB of memory.

How do I collect the following information: how large the total asa.sqlite dbs you've collected are and, if you know, how much memory is being consumed when you hit the out of memory error?

gfs commented 3 months ago

@ausetiad

  1. Size of databases: Look in the directory you're executing asa in and check the sizes of the asa.sqlite files
  2. Memory usage: Open Activity Monitor while executing ASA and watch the memory usage statistic.

You can also try to re-run export collect with --disableimplicitfindings which may reduce memory usage. Based on the output messages I think the out of memory is hit during construction of the sarif output file - removing implicit findings should reduce the size of that file.

ausetiad commented 3 months ago

Sizes of asa.sqlite files:

I'm going to try and get the memory usage info while running export collect with --disableimplicitfindings enabled

gfs commented 2 months ago

After further investigation the root cause of this appears to be that every file was reporting a different content hash between collection runs - but with no other changes resulting in a hugely inflated report. I am as of yet unable to repro this on a mac myself.