CVE-2024-7884

🗓️ 05 Sep 2024 13:01:20Reported by DfinityType

Memory leak in canister method via `ic_cdk::call`. Rust canisters using ic_cdk and ic_cdk_timers affected. Patched versions 0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-7884	5 Sep 202416:22	–	circl
CNNVD	Rust Canister Development Kit 安全漏洞	5 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-7884 Memory leak when calling a canister method via `ic_cdk::call`	5 Sep 202413:01	–	cvelist
EUVD	EUVD-2024-2871	3 Oct 202520:07	–	euvd
Github Security Blog	ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`	5 Sep 202416:44	–	github
NVD	CVE-2024-7884	5 Sep 202413:15	–	nvd
OSV	GHSA-RWQ6-CRJG-9CPW ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`	5 Sep 202416:44	–	osv
OSV	RUSTSEC-2024-0372 Memory leak when calling a canister method via `ic_cdk::call`	5 Sep 202412:00	–	osv
Positive Technologies	PT-2024-38658 · Ic Cdk · Ic Cdk	5 Sep 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-7884	5 Feb 202511:55	–	redhatcve

NVD

Node

dfinity canister_developer_kit_for_the_internet_computerRange0.8.0–0.8.2rust

dfinity canister_developer_kit_for_the_internet_computerRange0.9.0–0.9.3rust

dfinity canister_developer_kit_for_the_internet_computerRange0.11.0–0.11.6rust

dfinity canister_developer_kit_for_the_internet_computerRange0.12.0–0.12.2rust

dfinity canister_developer_kit_for_the_internet_computerRange0.13.0–0.13.5rust

dfinity canister_developer_kit_for_the_internet_computerMatch0.10.0rust

dfinity canister_developer_kit_for_the_internet_computerMatch0.14.0rust

dfinity canister_developer_kit_for_the_internet_computerMatch0.15.0rust

[
  {
    "collectionURL": "https://crates.io/crates/ic-cdk",
    "defaultStatus": "unaffected",
    "packageName": "ic-cdk",
    "product": "ic-cdk",
    "repo": "https://github.com/dfinity/cdk-rs",
    "vendor": "Internet Computer",
    "versions": [
      {
        "changes": [
          {
            "at": "0.8.2",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.8.2",
        "status": "affected",
        "version": "0.8.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "0.9.3",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.9.3",
        "status": "affected",
        "version": "0.9.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "0.10.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.10.1",
        "status": "affected",
        "version": "0.10.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "0.11.6",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.11.5",
        "status": "affected",
        "version": "0.11.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "0.12.2",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.12.2",
        "status": "affected",
        "version": "0.12.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "0.13.5",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.13.4",
        "status": "affected",
        "version": "0.13.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "0.14.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.14.1",
        "status": "affected",
        "version": "0.14.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "0.15.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "0.15.1",
        "status": "affected",
        "version": "0.15.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
docs	www.docs.rs/ic-cdk/latest/ic_cdk/
internetcomputer	www.internetcomputer.org/docs/current/references/ic-interface-spec
github	www.github.com/dfinity/cdk-rs/pull/509

12 Sep 2024 20:47Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.00118

SSVC

CWE-401