MongoDB Go Driver GSSAPI Authentication Heap Out-of-Bounds Read Vulnerability

A heap out-of-bounds read vulnerability has been identified in the MongoDB Go Driver's CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. This vulnerability arises from incorrect assumptions about string termination in the GSSAPI standard, leading to the potential for reading one byte past the end of allocated heap buffers. Such an out-of-bounds read could cause a crash, creating a denial-of-service condition, especially if the GSS library returns buffers allocated at page boundaries.

Impact

Exploitation of this vulnerability causes a heap out-of-bounds read, which can lead to a crash and potentially create a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by compiling the Go program with AddressSanitizer enabled, and then running it with a MongoDB URI that includes GSSAPI authentication. The program will read one byte past the end of GSSAPI buffers, creating the out-of-bounds read condition.

Remediation

Users can upgrade to MongoDB Go Driver versions 2.4.2 or 1.17.7, where this vulnerability has been fixed.