[SERVER-59071] Using $sample can trigger invariant when connecting directly to shards Created: 03/Aug/21  Updated: 29/Oct/23  Resolved: 11/Aug/21

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: 5.0.2
Fix Version/s: 5.0.3, 5.1.0-rc0

Type: Bug Priority: Major - P3
Reporter: Randolph Tan Assignee: Eric Cox (Inactive)
Resolution: Fixed Votes: 1
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: File test.js    
Issue Links:
Backports
Depends
Problem/Incident
Related
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v5.0
Sprint: QE 2021-08-09, QE 2021-08-23
Participants:
Case:
Linked BF Score: 176

 Description   
CVE-2021-32037

Title
User may trigger invariant when allowed to send commands directly to shards

CVE ID
CVE-2021-32037

Description

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment.

CVSS score
This issue's CVSS:3.1 severity is scored at 6.5 using the following scoring metrics:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions
MongoDB Server v5.0.0-v5.0.2

CWE
CWE-617: Reachable Assertion

Underlying operating systems affected
ALL

How the issue was reported:
Externally

External Reference link (server ticket)
SERVER-59071



 Comments   
Comment by Randolph Tan [ 06/Apr/22 ]

aju.raju@bnymellon.com This issue didn't exist before v5.0

Comment by Aju Raju [ 06/Apr/22 ]

Is this addressed in any MongoDB version prior to v5.0 (i.e.: v4.2).

Comment by Githook User [ 12/Aug/21 ]

Author:

{'name': 'Eric Cox', 'email': 'eric.cox@mongodb.com', 'username': 'ericox'}

Message: SERVER-59071 Treat '$sample' as unsharded when connecting directly to shards

(cherry picked from commit f3604b901d688c194de5e430c7fbab060c9dc8e0)
Branch: v5.0
https://github.com/mongodb/mongo/commit/a5e2f9b0a236462a6d1ca129583c617f111367b4

Comment by Githook User [ 11/Aug/21 ]

Author:

{'name': 'Eric Cox', 'email': 'eric.cox@mongodb.com', 'username': 'ericox'}

Message: SERVER-59071 Treat '$sample' as unsharded when connecting directly to shards
Branch: master
https://github.com/mongodb/mongo/commit/f3604b901d688c194de5e430c7fbab060c9dc8e0

Comment by Githook User [ 10/Aug/21 ]

Author:

{'name': 'Eric Cox', 'email': 'eric.cox@mongodb.com', 'username': 'ericox'}

Message: Revert "SERVER-59071 Treat '$sample' as unsharded when connecting directly to shards"

This reverts commit f3e8bfb0ea52ae167e097f3f3fd9bf183e6b4a8a.
Branch: master
https://github.com/mongodb/mongo/commit/ea7c4aad494ca70edb3a7876226a3f5321fda27b

Comment by Githook User [ 10/Aug/21 ]

Author:

{'name': 'Eric Cox', 'email': 'eric.cox@mongodb.com', 'username': 'ericox'}

Message: SERVER-59071 Treat '$sample' as unsharded when connecting directly to shards
Branch: master
https://github.com/mongodb/mongo/commit/f3e8bfb0ea52ae167e097f3f3fd9bf183e6b4a8a

Comment by Eric Cox (Inactive) [ 06/Aug/21 ]

The fix is pretty simple here and it uses what kaloian.manassiev suggests to only try to get the shardFilterer if we have already checked that the collection is sharded via CollectionShardingState:: getCollectionDescription()->isSharded(). When we direct connect to a shard and try a $sample in an agg pipeline, $sample will now run as if we are running $sample against a single node mongod.

 

Comment by Kaloian Manassiev [ 05/Aug/21 ]

Just want to add here that it is the responsibility of $sample to not try to use the orphan filter, if it is not run on a sharded collection. When directly connecting to a shard or executing as a replica set, all collections are unsharded for all intents and purposes. So I am passing this ticket to the Query Execution team. The fix would be to use CollectionShardingState:: getCollectionDescription()->isSharded() before deciding to attach the orphan filtering stage.

Comment by Randolph Tan [ 03/Aug/21 ]

Note: based on my testing, mongos attaches version (0, 0) for unsharded collections, so it doesn't hit this invariant when using $sample on them.

Generated at Thu Feb 08 05:46:16 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.