CVE-2024-6381

What it actually does

Integer overflow in bson_strfreev causes attempt to free memory at a negative offset, resulting in memory corruption within the libbson library.

Why it matters to the business

Applications using older MongoDB C driver versions may experience crashes or data integrity issues when processing certain inputs, increasing operational risk for dependent systems until upgraded.

How an attack unfolds

An attacker supplies crafted input that triggers the integer overflow in bson_strfreev during local processing, leading to memory corruption that may be leveraged for further impact such as denial of service.

How to fix it

Upgrade mongodb/mongo-c-driver to the fixed commit 586171d661f584d841bdc32fc998e9f6cf903228 or later equivalent release containing the libbson 1.26.2 fix.

How to confirm the fix worked

Verify installed libbson version is 1.26.2 or newer; confirm presence of the correcting commit in source; test with inputs that previously triggered the overflow to ensure no crash or corruption occurs.

Typical attack path

1. Identify application using vulnerable libbson version prior to 1.26.2
2. Craft input that causes integer overflow in bson_strfreev
3. Trigger function execution to induce memory corruption at negative offset
4. Observe resulting application instability or corruption effects

How to detect it

Review application logs and crash dumps for references to bson_strfreev failures or memory errors; inspect process behavior around BSON parsing functions for signs of corruption.

• bson_strfreev

What your security team should do

• Immediately update all instances of mongo-c-driver to the fixed commit version
• Scan codebases and dependency manifests for references to vulnerable libbson versions
• Monitor for application crashes involving bson_strfreev and prioritize patching in high-usage environments