Read the docs
TI-2024-07307 Aliases CVE-2024-7884GHSA-rwq6-crjg-9cpw

Memory leak when calling a canister method via `ic_cdk::call`

Priority MEDIUM 40CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-401.

Summary

When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture allows multiple references to be held for this internal state and not all references were dropped before the Future is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. Impact Canisters built in Rust with ic_cdk and ic_cdk_timers are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. In the worst case, this could lead to heap memory exhaustion triggered by an attacker. Motoko based canisters are not affected by the bug. PatchesThe patch has been backported to all minor versions between >= 0.8.0, <= 0.15.0. The patched versions available are 0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1 and their previous versions have been yanked. WorkaroundsThere are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of ic_cdk to avoid running out of Wasm heap memory. Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00693 53rd percentileScored 2026-11-07
Fix Fixed ic-cdk (Internet Computer): 0.8.2, 0.9.3, 0.10.1 +5ic_cdk (crates.io): 0.8.2, 0.9.3, 0.10.1 +5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Internet Computeric-cdk0.8.0 to before 0.8.2; 0.9.0 to before 0.9.3; 0.10.0 to before 0.10.1; 0.11.0 to before 0.11.5; 0.12.0 to before 0.12.2; 0.13.0 to before 0.13.4; 0.14.0 to before 0.14.1; 0.15.0 to before 0.15.10.8.2, 0.9.3, 0.10.1, 0.11.5, 0.12.2, 0.13.4, 0.14.1, 0.15.1Patch availableCNA
—ic_cdk (crates.io)0.8.0 to before 0.8.20.8.2Patch availableGHSA-rwq6-crjg-9cpw
—ic_cdk (crates.io)0.9.0 to before 0.9.30.9.3Patch availableGHSA-rwq6-crjg-9cpw
—ic_cdk (crates.io)0.10.0 to before 0.10.10.10.1Patch availableGHSA-rwq6-crjg-9cpw
—ic_cdk (crates.io)0.11.0 to before 0.11.60.11.6Patch availableGHSA-rwq6-crjg-9cpw
—ic_cdk (crates.io)0.12.0 to before 0.12.20.12.2Patch availableGHSA-rwq6-crjg-9cpw
—ic_cdk (crates.io)0.13.0 to before 0.13.50.13.5Patch availableGHSA-rwq6-crjg-9cpw
—ic_cdk (crates.io)0.14.0 to before 0.14.10.14.1Patch availableGHSA-rwq6-crjg-9cpw
—ic_cdk (crates.io)0.15.0 to before 0.15.10.15.1Patch availableGHSA-rwq6-crjg-9cpw
  • ic-cdk VendorInternet Computer Affected 0.8.0 to before 0.8.2; 0.9.0 to before 0.9.3; 0.10.0 to before 0.10.1; 0.11.0 to before 0.11.5; 0.12.0 to before 0.12.2; 0.13.0 to before 0.13.4; 0.14.0 to before 0.14.1; 0.15.0 to before 0.15.1 Fixed in 0.8.2, 0.9.3, 0.10.1, 0.11.5, 0.12.2, 0.13.4, 0.14.1, 0.15.1 Patch available CNA
  • ic_cdk (crates.io) Vendor— Affected 0.8.0 to before 0.8.2 Fixed in 0.8.2 Patch available GHSA-rwq6-crjg-9cpw
  • ic_cdk (crates.io) Vendor— Affected 0.9.0 to before 0.9.3 Fixed in 0.9.3 Patch available GHSA-rwq6-crjg-9cpw
  • ic_cdk (crates.io) Vendor— Affected 0.10.0 to before 0.10.1 Fixed in 0.10.1 Patch available GHSA-rwq6-crjg-9cpw
  • ic_cdk (crates.io) Vendor— Affected 0.11.0 to before 0.11.6 Fixed in 0.11.6 Patch available GHSA-rwq6-crjg-9cpw
  • ic_cdk (crates.io) Vendor— Affected 0.12.0 to before 0.12.2 Fixed in 0.12.2 Patch available GHSA-rwq6-crjg-9cpw
  • ic_cdk (crates.io) Vendor— Affected 0.13.0 to before 0.13.5 Fixed in 0.13.5 Patch available GHSA-rwq6-crjg-9cpw
  • ic_cdk (crates.io) Vendor— Affected 0.14.0 to before 0.14.1 Fixed in 0.14.1 Patch available GHSA-rwq6-crjg-9cpw
  • ic_cdk (crates.io) Vendor— Affected 0.15.0 to before 0.15.1 Fixed in 0.15.1 Patch available GHSA-rwq6-crjg-9cpw

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:*:*:*:*:*:rust:*:*0.8.0 to before 0.8.2; 0.9.0 to before 0.9.3; 0.11.0 to before 0.11.6; 0.12.0 to before 0.12.2; 0.13.0 to before 0.13.5VulnerableInternet Computer
cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:0.10.0:*:*:*:*:rust:*:*0.10.0VulnerableInternet Computer
cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:0.14.0:*:*:*:*:rust:*:*0.14.0VulnerableInternet Computer
cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:0.15.0:*:*:*:*:rust:*:*0.15.0VulnerableInternet Computer
  • cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:*:*:*:*:*:rust:*:* Versions 0.8.0 to before 0.8.2; 0.9.0 to before 0.9.3; 0.11.0 to before 0.11.6; 0.12.0 to before 0.12.2; 0.13.0 to before 0.13.5 Vulnerable ·Internet Computer
  • cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:0.10.0:*:*:*:*:rust:*:* Versions 0.10.0 Vulnerable ·Internet Computer
  • cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:0.14.0:*:*:*:*:rust:*:* Versions 0.14.0 Vulnerable ·Internet Computer
  • cpe:2.3:a:dfinity:canister_developer_kit_for_the_internet_computer:0.15.0:*:*:*:*:rust:*:* Versions 0.15.0 Vulnerable ·Internet Computer

Remediation

  • Fix · CNA ic-cdk (Internet Computer) Fixed in 0.8.2, 0.9.3, 0.10.1, 0.11.5, 0.12.2, 0.13.4, 0.14.1, 0.15.1
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.8.2 Advisory →
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.9.3 Advisory →
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.10.1 Advisory →
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.11.6 Advisory →
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.12.2 Advisory →
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.13.5 Advisory →
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.14.1 Advisory →
  • Fix · GHSA-rwq6-crjg-9cpw ic_cdk (crates.io) Fixed in 0.15.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7884
  2. 2026-10-03 Alias added: GHSA-rwq6-crjg-9cpw

References

Patch 1

Advisory 1

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences