Skip to content

Commit 11b7b64

Browse files
RaghavArora14RaghavArora14
committed
Add Supabase CREs 140-142 and resolve conflicts
- Add CRE-2025-0140: Supabase Realtime Invalid Config - Add CRE-2025-0141: Supabase Disk Full Migration - Add CRE-2025-0142: Supabase SSL Certificate Missing - Update test logs for Kubernetes exit code CREs (134, 137, 139) - Include Kubernetes exit code YAML files from PR #137
1 parent 396d2aa commit 11b7b64

File tree

12 files changed

+415
-32
lines changed

12 files changed

+415
-32
lines changed

‎rules/cre-2025-0134/cre-exit-134.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
rules:
2+
- metadata:
3+
kind: prequel
4+
id: T8tPh6u4Bj7nXidQWbRvvj
5+
cre:
6+
id: CRE-2025-0134
7+
severity: 2
8+
title: Container exited 134 due to SIGABRT / assertion failure
9+
category: runtime-problem
10+
author: CRE Community
11+
description: |
12+
Exit code 134 indicates the process aborted via SIGABRT, commonly due to failed assertions,
13+
allocator checks (e.g., glibc detecting heap corruption), or explicit abort() calls.
14+
cause: |
15+
- assert(false) / std::abort() in C/C++.
16+
- Memory allocator consistency errors (double free, corruption).
17+
- Defensive abort on unrecoverable invariant violations.
18+
impact: |
19+
- Immediate termination of the container; possible loss of in-flight work.
20+
- Repeated crashes if the triggering condition is deterministic at startup.
21+
tags:
22+
- k8s
23+
- exit-code
24+
- sigabrt
25+
- assertion
26+
- native
27+
mitigation: |
28+
- Enable core dumps and symbols; capture backtraces.
29+
- Run ASAN/UBSAN builds in staging to localize corruption.
30+
- Pin and verify libc/libstdc++ versions; roll back recent native changes.
31+
references:
32+
- "https://www.gnu.org/software/libc/manual/html_node/Aborting-a-Program.html"
33+
applications:
34+
- name: kubernetes
35+
version: ">=1.16"
36+
impactScore: 6
37+
mitigationScore: 2
38+
reports: 4
39+
rule:
40+
set:
41+
event:
42+
source: cre.log.k8s
43+
match:
44+
- regex: "^[^\\t]+\\t[^\\t/]+/[^\\t]+\\t[^\\t]+\\t[^\\t]*\\t134$"

‎rules/cre-2025-0134/test.log‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1 @@
1-
2025-01-28T10:35:10Z ERROR supabase-realtime invalid replication mode: 'invalid_mode' is not a supported replication mode
2-
2025-01-28T10:35:10Z ERROR supabase-realtime REPLICATION_MODE configuration error: unknown value 'invalid_mode'
3-
2025-01-28T10:35:11Z ERROR supabase-realtime realtime configuration error: INVALID_CONFIG_PARAM is not recognized
4-
2025-01-28T10:35:11Z ERROR supabase-realtime SECRET_KEY_BASE must be at least 64 characters long
5-
2025-01-28T10:35:12Z ERROR supabase-realtime DB_ENC_KEY missing or invalid format
6-
2025-01-28T10:35:12Z ERROR supabase-realtime realtime startup failed: configuration validation error
7-
2025-01-28T10:35:13Z ERROR supabase-realtime websocket connection failed: invalid configuration
8-
2025-01-28T10:35:13Z ERROR supabase-realtime elixir application failed to start: configuration error
9-
2025-01-28T10:35:14Z ERROR supabase-realtime realtime service crash: {:error, :invalid_config}
10-
11-
1+
2025-08-27T13:26:39Z cre-demo/abort-134 aborter Error 134

‎rules/cre-2025-0137/cre-exit-137.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
rules:
2+
- metadata:
3+
kind: prequel
4+
id: VuPxiuWkYodzUqupa7gh9N
5+
cre:
6+
id: CRE-2025-0137
7+
severity: 1
8+
title: Pod terminated with Exit Code 137 due to OOMKilled (memory limit exceeded)
9+
category: memory-problem
10+
author: CRE Community
11+
description: |
12+
The container exceeded its memory limit and was killed by the kernel OOM killer.
13+
Kubernetes reports a terminated state with Reason=OOMKilled and exitCode=137.
14+
This often manifests as CrashLoopBackOff under sustained memory pressure.
15+
cause: |
16+
- Memory limit too low relative to peak usage.
17+
- Sudden traffic spikes causing allocation bursts.
18+
- Memory leaks or fragmentation in long-running processes.
19+
- Under-provisioned nodes or overly strict pod limits.
20+
impact: |
21+
- Request errors and latency spikes during restarts.
22+
- CrashLoopBackOff and reduced availability.
23+
- Potential loss of in-flight work not checkpointed to durable storage.
24+
tags:
25+
- k8s
26+
- exit-code
27+
- out-of-memory
28+
- memory
29+
- crash-loop
30+
- reliability
31+
mitigation: |
32+
- Raise memory requests/limits; add headroom for peak allocations.
33+
- Enable profiling and leak detection; tune GC/heap where applicable.
34+
- Consider Vertical Pod Autoscaler for right-sizing.
35+
- Watch node memory pressure and eviction thresholds.
36+
references:
37+
- "https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-states"
38+
- "https://kubernetes.io/docs/tasks/administer-cluster/out-of-resource/"
39+
applications:
40+
- name: kubernetes
41+
version: ">=1.16"
42+
impactScore: 6
43+
mitigationScore: 2
44+
reports: 12
45+
rule:
46+
set:
47+
event:
48+
source: cre.log.k8s
49+
match:
50+
- regex: "^[^\\t]+\\t[^\\t/]+/[^\\t]+\\t[^\\t]+\\tOOMKilled\\t137$"

‎rules/cre-2025-0137/test.log‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1 @@
1-
2025-01-28T10:50:32Z ERROR supabase-db ERROR: could not write to file "base/13442/16384": No space left on device
2-
2025-01-28T10:50:32Z ERROR supabase-db FATAL: could not write to WAL file: No space left on device
3-
2025-01-28T10:50:33Z ERROR supabase-db ERROR: disk full, could not extend file "base/13442/16385" to 8192 blocks
4-
2025-01-28T10:50:33Z ERROR supabase-db checkpoint request failed: No space left on device
5-
2025-01-28T10:50:34Z ERROR supabase-db ERROR: could not create file "pg_wal/000000010000000000000002": No space left on device
6-
2025-01-28T10:50:34Z ERROR supabase-db FATAL: insufficient disk space for WAL files
7-
2025-01-28T10:50:35Z ERROR supabase-db ERROR: could not write block 1048576 of temporary file: No space left on device
8-
2025-01-28T10:50:35Z ERROR supabase-db migration failed: disk full during large data operation
9-
10-
1+
2025-08-27T11:51:17Z cre-demo/oom-137 eater OOMKilled 137

‎rules/cre-2025-0139/cre-exit-139.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
rules:
2+
- metadata:
3+
kind: prequel
4+
id: KHtVUpTbZHaevdn4EABmQEe
5+
cre:
6+
id: CRE-2025-0139
7+
severity: 2
8+
title: Container exited 139 due to segmentation fault (SIGSEGV)
9+
category: runtime-problem
10+
author: CRE Community
11+
description: |
12+
Exit code 139 indicates SIGSEGV (invalid memory access) in native/runtime code.
13+
Frequently caused by unsafe pointer operations, ABI/library mismatches, or native extensions.
14+
cause: |
15+
- Null dereference or out-of-bounds access in C/C++/Rust unsafe blocks.
16+
- Incompatible glibc/musl or driver/library versions.
17+
- Faulty JNI/ctypes/native extension code paths.
18+
impact: |
19+
- Hard crash; requests being processed may be dropped.
20+
- Repeated crashes if the segfault occurs deterministically at startup.
21+
tags:
22+
- k8s
23+
- exit-code
24+
- segfault
25+
- native
26+
- reliability
27+
mitigation: |
28+
- Enable core dumps and symbol files; capture stack traces.
29+
- Pin compatible base image/libc; verify ABI expectations.
30+
- Use ASAN/UBSAN builds; bisect recent native/library changes.
31+
references:
32+
- "https://man7.org/linux/man-pages/man7/signal.7.html"
33+
applications:
34+
- name: kubernetes
35+
version: ">=1.16"
36+
impactScore: 7
37+
mitigationScore: 2
38+
reports: 5
39+
rule:
40+
set:
41+
event:
42+
source: cre.log.k8s
43+
match:
44+
- regex: "^[^\\t]+\\t[^\\t/]+/[^\\t]+\\t[^\\t]+\\t[^\\t]*\\t139$"

‎rules/cre-2025-0139/test.log‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1 @@
1-
2025-01-28T11:00:12Z ERROR supabase-kong SSL certificate not found: /etc/ssl/certs/server.crt: no such file or directory
2-
2025-01-28T11:00:12Z ERROR supabase-kong SSL configuration error: certificate file missing or unreadable
3-
2025-01-28T11:00:13Z ERROR supabase-kong invalid certificate format: unable to load certificate
4-
2025-01-28T11:00:13Z ERROR supabase-kong certificate verification failed: invalid certificate content
5-
2025-01-28T11:00:14Z ERROR supabase-kong SSL handshake failed: certificate and key do not match
6-
2025-01-28T11:00:14Z ERROR supabase-kong permission denied reading certificate: /etc/ssl/private/server.key
7-
2025-01-28T11:00:15Z ERROR supabase-kong certificate expired: not valid after 2024-01-01T00:00:00Z
8-
2025-01-28T11:00:15Z ERROR supabase-kong SSL cert invalid: unable to verify certificate chain
9-
2025-01-28T11:00:16Z ERROR supabase-kong TLS configuration failed: missing SSL certificate files
10-
11-
1+
2025-08-27T13:32:40Z cre-demo/segv-139 segv Error 139

‎rules/cre-2025-0140/supabase-realtime-invalid-config.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
rules:
2+
- metadata:
3+
kind: prequel
4+
id: SB5R34lt1m3C1nf1gErr1r
5+
gen: 1
6+
cre:
7+
id: CRE-2025-0140
8+
severity: 2
9+
title: "Supabase Self-Hosted: Realtime Service Crash Due to Invalid Configuration"
10+
category: "realtime-problem"
11+
author: Prequel
12+
description: |
13+
Detects when Supabase Realtime service fails to start or crashes due to invalid configuration parameters.
14+
This affects WebSocket connections, real-time subscriptions, and live data streaming capabilities.
15+
Common issues include invalid replication modes, missing database permissions, or incorrect environment variables.
16+
cause: |
17+
- Invalid REPLICATION_MODE configuration value
18+
- Incorrect database connection parameters for realtime
19+
- Missing or wrong DB_ENC_KEY encryption key
20+
- Invalid SECRET_KEY_BASE configuration
21+
- Insufficient database permissions for realtime operations
22+
- Wrong FLY_* configuration parameters in non-Fly environments
23+
tags:
24+
- supabase
25+
- realtime
26+
- configuration
27+
- replication
28+
- connection
29+
- self-hosted
30+
- configuration-failure
31+
- public
32+
mitigation: |
33+
IMMEDIATE:
34+
- Check realtime service logs: `docker-compose logs realtime`
35+
- Validate realtime environment variables in .env
36+
- Ensure database is accessible from realtime service
37+
CONFIGURATION:
38+
- Remove invalid REPLICATION_MODE if not using custom replication
39+
- Verify database connection settings:
40+
```
41+
DB_HOST=db
42+
DB_PORT=5432
43+
DB_USER=supabase_realtime_admin
44+
```
45+
- Set valid SECRET_KEY_BASE (64+ character random string)
46+
- Remove FLY_* variables if not deploying on Fly.io
47+
DATABASE:
48+
- Ensure realtime schema exists and has proper permissions
49+
- Check if supabase_realtime_admin role exists and has access
50+
- Verify _realtime schema is properly configured
51+
references:
52+
- https://supabase.com/docs/guides/realtime
53+
- https://github.com/supabase/realtime
54+
applications:
55+
- name: realtime
56+
containerName: supabase-realtime
57+
version: "v2.*"
58+
impact: |
59+
- Real-time subscriptions fail to connect
60+
- WebSocket connections are rejected
61+
- Live data updates stop working
62+
- Real-time features in applications become unavailable
63+
- Database change notifications are not delivered
64+
impactScore: 6
65+
mitigationScore: 5
66+
reports: 12
67+
rule:
68+
set:
69+
window: 5m
70+
event:
71+
source: cre.log.realtime
72+
match:
73+
- regex: 'invalid.*replication.*mode|REPLICATION_MODE.*unknown|realtime.*configuration.*error'
74+
- regex: 'SECRET_KEY_BASE.*invalid|DB_ENC_KEY.*missing|realtime.*startup.*failed'
75+
- regex: 'websocket.*connection.*failed|realtime.*service.*crash|elixir.*application.*failed'
76+
- value: "realtime"
77+
78+

‎rules/cre-2025-0140/test.log‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
2025-01-28T10:35:10Z ERROR supabase-realtime invalid replication mode: 'invalid_mode' is not a supported replication mode
2+
2025-01-28T10:35:10Z ERROR supabase-realtime REPLICATION_MODE configuration error: unknown value 'invalid_mode'
3+
2025-01-28T10:35:11Z ERROR supabase-realtime realtime configuration error: INVALID_CONFIG_PARAM is not recognized
4+
2025-01-28T10:35:11Z ERROR supabase-realtime SECRET_KEY_BASE must be at least 64 characters long
5+
2025-01-28T10:35:12Z ERROR supabase-realtime DB_ENC_KEY missing or invalid format
6+
2025-01-28T10:35:12Z ERROR supabase-realtime realtime startup failed: configuration validation error
7+
2025-01-28T10:35:13Z ERROR supabase-realtime websocket connection failed: invalid configuration
8+
2025-01-28T10:35:13Z ERROR supabase-realtime elixir application failed to start: configuration error
9+
2025-01-28T10:35:14Z ERROR supabase-realtime realtime service crash: {:error, :invalid_config}
10+
11+

‎rules/cre-2025-0141/supabase-disk-full-migration.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
rules:
2+
- metadata:
3+
kind: prequel
4+
id: SB8D1skFullMigrat11nErr
5+
gen: 1
6+
cre:
7+
id: CRE-2025-0141
8+
severity: 1
9+
title: "Supabase Self-Hosted: Disk Full During Database Migration Operations"
10+
category: "storage-problem"
11+
author: Prequel
12+
description: |
13+
Detects when Supabase PostgreSQL database operations fail due to insufficient disk space during migrations,
14+
data imports, or large transactions. This can corrupt the database, leave migrations in inconsistent state,
15+
and cause complete service failure requiring manual intervention.
16+
cause: |
17+
- Insufficient disk space for database operations
18+
- Large migration files that exceed available storage
19+
- WAL (Write-Ahead Log) files consuming all available space
20+
- Temporary tables or indexes requiring more space than available
21+
- Docker volume size limits reached
22+
- Database backup/restore operations running out of space
23+
tags:
24+
- supabase
25+
- postgres
26+
- disk-full
27+
- storage
28+
- migration-failure
29+
- wal
30+
- self-hosted
31+
- critical-failure
32+
- data-loss-risk
33+
- public
34+
mitigation: |
35+
IMMEDIATE:
36+
- Stop database operations: `docker-compose stop db`
37+
- Check disk usage: `df -h` and `docker system df`
38+
- Free up disk space by removing unnecessary files
39+
- Increase volume size or move to larger storage
40+
RECOVERY:
41+
- Restart database service after freeing space
42+
- Check database integrity: `docker-compose exec db pg_check`
43+
- Manually complete failed migrations if needed
44+
- Restore from backup if database is corrupted
45+
PREVENTION:
46+
- Monitor disk usage continuously
47+
- Set up disk space alerts (< 10% free)
48+
- Use larger Docker volumes for production
49+
- Implement automated cleanup of old WAL files
50+
- Test migrations on staging with similar data volumes
51+
- Configure PostgreSQL to limit WAL retention
52+
references:
53+
- https://www.postgresql.org/docs/current/wal-internals.html
54+
- https://www.postgresql.org/docs/current/disk-usage.html
55+
applications:
56+
- name: postgres
57+
containerName: supabase-db
58+
version: "15.*"
59+
impact: |
60+
- Database corruption and data loss risk
61+
- Incomplete migrations leaving schema in inconsistent state
62+
- Complete service outage until disk space resolved
63+
- Potential need for database restore from backup
64+
- Development/production environment downtime
65+
impactScore: 10
66+
mitigationScore: 7
67+
reports: 8
68+
rule:
69+
set:
70+
window: 5m
71+
event:
72+
source: cre.log.supabase
73+
match:
74+
- regex: 'No space left on device|disk full|insufficient disk space'
75+
- regex: 'could not.*write.*WAL|checkpoint.*failed.*disk full'
76+
- regex: 'ERROR.*disk full|could not extend file.*No space left'
77+
- value: "migration"
78+
79+

‎rules/cre-2025-0141/test.log‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2025-01-28T10:50:32Z ERROR supabase-db ERROR: could not write to file "base/13442/16384": No space left on device
2+
2025-01-28T10:50:32Z ERROR supabase-db FATAL: could not write to WAL file: No space left on device
3+
2025-01-28T10:50:33Z ERROR supabase-db ERROR: disk full, could not extend file "base/13442/16385" to 8192 blocks
4+
2025-01-28T10:50:33Z ERROR supabase-db checkpoint request failed: No space left on device
5+
2025-01-28T10:50:34Z ERROR supabase-db ERROR: could not create file "pg_wal/000000010000000000000002": No space left on device
6+
2025-01-28T10:50:34Z ERROR supabase-db FATAL: insufficient disk space for WAL files
7+
2025-01-28T10:50:35Z ERROR supabase-db ERROR: could not write block 1048576 of temporary file: No space left on device
8+
2025-01-28T10:50:35Z ERROR supabase-db migration failed: disk full during large data operation
9+
10+

0 commit comments

Comments
 (0)