OpenTelemetry eBPF Instrumentation MongoDB Parser Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the OpenTelemetry eBPF Instrumentation MongoDB parser, present in versions 0.1.0 prior to 0.9.0. The issue arises when malformed MongoDB wire messages are processed, leading to uncaught panics that crash the telemetry agent. This vulnerability allows remote, unauthenticated attackers to disrupt telemetry collection by sending crafted messages that exploit the parser's lack of input validation, causing a process termination that requires a manual restart.

Impact

Exploitation of this vulnerability causes the OpenTelemetry eBPF Instrumentation telemetry agent to crash, disrupting observability and requiring a process restart to resume normal operations.

Reproduction

The vulnerability can be reproduced by sending malformed MongoDB wire messages that trigger the parser's uncaught panics. This can be done by using a test file that simulates the malformed messages and running it against the affected parser code in the OpenTelemetry eBPF Instrumentation repository.

Remediation

Users can upgrade to OpenTelemetry eBPF Instrumentation version 0.9.0 or later, where this vulnerability has been patched.