MongoDB Crash Loop(CRE-2025-0120) (#109)

* mongodb crash loop

* fix

* fix

* fix tags

* fix tags

* fix: reference link

* fix: conflict

* fix: test

* fix: duplicate

Author: aryel780

rules/cre-2025-0129/mongodb-crash-loop.yaml

@@ -0,0 +1,47 @@
+rules:
+  - metadata:
+      kind: prequel
+      id: DQbJmYTnPqvL6HdX2Xs7Wh
+    cre:
+      id: CRE-2025-0093
+      severity: 0
+      title: MongoDB Crash Loop Due to WiredTiger Metadata Corruption
+      category: mongodb-startup-failure
+      author: Community
+      description: |
+        Detects MongoDB failures where the server enters a crash loop due to corrupted WiredTiger metadata.
+        This prevents startup and often requires manual repair or restoration from backups.
+      cause: |
+        WiredTiger metadata corruption caused by unclean shutdowns, disk failures, or filesystem issues. 
+        MongoDB is unable to initialize its storage engine due to invalid or unreadable metadata.
+      impact: |
+        Database remains unavailable due to repeated startup failures. 
+        Services relying on MongoDB experience outages and potential data loss.
+        Errors referencing WiredTiger metadata corruption are observed in the logs.
+      impactScore: 10
+      tags:
+        - mongodb
+        - wiredtiger
+        - metadata
+        - corruption
+        - crash-loop
+        - startup-failure
+      mitigation: |
+        Prevent unclean shutdowns, monitor disk and filesystem health, run regular backups.
+        If corruption occurs, attempt recovery with mongod --repair, or restore from a known good backup.
+      mitigationScore: 9
+      references:
+        - https://www.mongodb.com/docs/manual/administration/repair/
+        - https://jira.mongodb.org/browse/SERVER-37978
+        - https://www.mongodb.com/community/forums/t/failed-to-start-wiredtiger-after-system-upgrade/13088
+      applications:
+        - name: mongod
+          version: ">=4.2"
+
+    rule:
+      set:
+        event:
+          source: cre.log.mongodb
+        match:
+          - regex: '(?i)WiredTiger.*metadata.*corrupt'
+            count: 1

rules/cre-2025-0129/test.log

@@ -0,0 +1,13 @@
+2025-07-06 18:34:21.262 [INF] Starting mongod
+2025-07-06 18:34:21.264 [INF] db version v4.4.26
+2025-07-06 18:34:21.264 [INF] git version: 971c204888dd1b6d1072442a3f958e3e52a5d2d0
+2025-07-06 18:34:21.265 [INF] build environment: Ubuntu 20.04
+2025-07-06 18:34:21.265 [INF] Using storage engine: WiredTiger
+2025-07-06 18:34:21.265 [INF] WiredTiger message: [1674512923:123456][1:0x7f8b4e7d0700], file:WiredTiger.wt, WT_SESSION.open_cursor: __wt_btree_open, 508: WiredTiger metadata file is corrupt
+2025-07-06 18:34:21.266 [ERR] WiredTiger metadata file is corrupt
+2025-07-06 18:34:21.266 [ERR] WiredTiger: [WT_SESSION] Failed to open WiredTiger metadata
+2025-07-06 18:34:21.266 [ERR] WiredTiger failed to initialize due to metadata corruption
+2025-07-06 18:34:21.267 [ERR] MongoDB encountered fatal error during startup
+2025-07-06 18:34:21.267 [ERR] MongoDB crash loop due to WiredTiger metadata corruption
+2025-07-06 18:34:21.268 [INF] For more information, see: https://www.mongodb.com/docs/manual/administration/repair/
+2025-07-06 18:34:21.268 [INF] Attempting automatic shutdown due to unrecoverable error

rules/tags/categories.yaml

@@ -239,4 +239,8 @@ categories:
   - name: database-availability
     displayName: Database Availability
     description: Critical failures affecting database service availability, including crashes, OOM kills, and unplanned terminations that require immediate recovery
-
+  - name: mongodb-startup-failure
+    displayName: MongoDB Startup Failure
+    description: |
+      Failures that prevent MongoDB from starting successfully due to corrupted metadata, invalid configurations,
+      or unrecoverable internal errors (e.g., WiredTiger metadata corruption). These failures often require manual repair or backup restoration.

rules/tags/tags.yaml

@@ -645,9 +645,6 @@ tags:
   - name: assertion
     displayName: Assertion
     description: Assertion failures indicating internal consistency checks or invariants violated at runtime.  
-  - name: crash-loop
-    displayName: Crash Loop
-    description: Repeated process restarts due to persistent failures causing operational impact.
   - name: redpanda-startup
     displayName: Redpanda Startup
     description: Problems related to Redpanda startup, such as configuration issues or missing state
@@ -814,7 +811,16 @@ tags:
     description: Problems related to MongoDB database system
   - name: wiredtiger
     displayName: WiredTiger
-    description: Problems related to MongoDB's WiredTiger storage engine
+    description: Issues related to MongoDB's default storage engine, WiredTiger, including corruption, crash loops, and initialization errors.
+  - name: metadata
+    displayName: Metadata
+    description: Failures caused by corrupted or unreadable metadata files used by the application to track state.
+  - name: crash-loop
+    displayName: Crash Loop
+    description: Repeated failure to start or recover due to a persistent internal problem, such as corrupted state or misconfiguration.
+  - name: corruption
+    displayName: Corruption
+    description: Issues involving data corruption, including damaged files, invalid data structures, or inconsistencies caused by software or hardware faults.
   - name: oom-kill
     displayName: OOM Kill
     description: Problems where processes are terminated by the OS Out-Of-Memory killer