CVE-2024-6381 Overview
CVE-2024-6381 is an integer overflow vulnerability in the bson_strfreev function of the MongoDB C driver library (libbson). The flaw causes the function to attempt to free memory at a negative offset, which can result in memory corruption. All libbson versions prior to 1.26.2 are affected. The issue is tracked under [CWE-680: Integer Overflow to Buffer Overflow].
Critical Impact
Memory corruption in libbson can destabilize applications that parse BSON data, potentially affecting integrity and availability of MongoDB client workloads across Linux distributions bundling the library.
Affected Products
- MongoDB libbson versions prior to 1.26.2
- MongoDB C Driver (mongo-c-driver) builds embedding vulnerable libbson
- Debian LTS distributions shipping affected libbson packages
Discovery Timeline
- 2024-07-02 - CVE-2024-6381 published to the National Vulnerability Database (NVD)
- 2025-05 - Debian LTS security advisories released for affected packages
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-6381
Vulnerability Analysis
The bson_strfreev function iterates over an array of string pointers and releases each allocation. The vulnerability arises when the function computes an index or length using arithmetic that can overflow the signed integer type used for iteration or offset tracking.
When the overflow occurs, the resulting value wraps to a negative number. The function then dereferences or frees memory at a negative offset from the base pointer. This behavior corrupts heap metadata or adjacent allocations, depending on the allocator implementation.
Applications using libbson to process attacker-influenced BSON documents inherit this exposure. The vulnerability is classified under [CWE-680], where an integer overflow leads to memory operations outside the intended bounds.
Root Cause
The root cause is unchecked integer arithmetic inside bson_strfreev. The function does not validate that the computed offset or count remains within the positive range of its integer type before performing pointer arithmetic and calling the deallocator.
Attack Vector
The attack vector is network-based when a vulnerable service parses BSON payloads originating from untrusted sources. An attacker who can influence the string array processed by bson_strfreev can trigger the overflow condition. The scope is limited to integrity impact, with no authentication required. See the MongoDB Jira issue CDRIVER-5622 for upstream tracking.
No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-6381
Indicators of Compromise
- Unexpected crashes or SIGSEGV signals in processes linked against libbson below version 1.26.2
- Heap corruption warnings emitted by glibc such as free(): invalid pointer or malloc_consolidate(): invalid chunk size in application logs
- Abnormal termination of MongoDB client applications immediately after processing BSON responses or documents
Detection Strategies
- Inventory installed packages and application dependencies to identify builds of libbson or mongo-c-driver earlier than 1.26.2
- Run software composition analysis (SCA) tooling against source repositories and container images to flag vulnerable libbson versions
- Correlate crash telemetry from endpoints with the presence of libbson in the affected process address space
Monitoring Recommendations
- Monitor process crash events and core dumps on hosts running MongoDB client workloads
- Track package update status across Linux fleets using configuration management or vulnerability management platforms
- Enable AddressSanitizer (ASan) in non-production builds of applications that link libbson to surface memory corruption during testing
How to Mitigate CVE-2024-6381
Immediate Actions Required
- Upgrade libbson and the MongoDB C driver to version 1.26.2 or later across all systems
- Apply distribution security updates, including the Debian LTS advisory msg00012 and Debian LTS advisory msg00027
- Rebuild and redeploy statically linked applications and container images that bundle the vulnerable library
Patch Information
MongoDB fixed the integer overflow in libbson 1.26.2. Upstream tracking and patch details are available at MongoDB Jira CDRIVER-5622. Downstream package updates are published through Debian LTS and other distribution security channels.
Workarounds
- Restrict network exposure of services that parse BSON documents from untrusted sources until the patch is applied
- Validate and constrain the size of string arrays passed to BSON processing routines at the application layer
- Enable operating system hardening features such as MALLOC_CHECK_ and heap protections to increase the likelihood of detecting corruption before exploitation succeeds
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
