{"id":"CVE-2024-7884","aliases":["GHSA-rwq6-crjg-9cpw","RUSTSEC-2024-0372"],"url":"https://o3.security/vulnerability/CVE-2024-7884","summary":"Memory leak when calling a canister method via `ic_cdk::call`","details":"When a canister method is called via `ic_cdk::call*`, a new Future `CallFuture` is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called `CallFutureState`.  A bug in the polling implementation of the `CallFuture` allows multiple references to be held for this internal state and not all references were dropped before the `Future` is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. \n\n### Impact\nCanisters built in Rust with `ic_cdk` and `ic_cdk_timers` are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. **In the worst case, this could lead to heap memory exhaustion triggered by an attacker.**\n\nMotoko based canisters are not affected by the bug.\n\n### Patches\nThe patch has been backported to all minor versions between `>= 0.8.0, <= 0.15.0`. The patched versions available are `0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1` and their previous versions have been yanked. \n\n### Workarounds\nThere are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of `ic_cdk` to avoid running out of Wasm heap memory. \n\n> [!NOTE]  \n> Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.\n\n### References\n- [dfinity/cdk-rs/pull/509](https://github.com/dfinity/cdk-rs/pull/509)\n- [ic_cdk docs](https://docs.rs/ic-cdk/latest/ic_cdk/)\n- [Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)","published":"2024-09-05T13:01:20.585Z","modified":"2026-10-28T02:30:48.759546072Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.8.2"},{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.9.3"},{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.10.1"},{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.11.6"},{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.12.2"},{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.13.5"},{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.14.1"},{"ecosystem":"crates.io","name":"ic_cdk","fixedVersion":"0.15.1"}],"fix":{"url":"https://github.com/dfinity/cdk-rs/pull/509","label":"dfinity/cdk-rs#509"},"references":[{"type":"WEB","url":"https://crates.io/crates/ic-cdk"},{"type":"WEB","url":"https://docs.rs/ic-cdk/latest/ic_cdk/"},{"type":"WEB","url":"https://internetcomputer.org/docs/current/references/ic-interface-spec"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7884.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7884"},{"type":"FIX","url":"https://github.com/dfinity/cdk-rs/pull/509"},{"type":"PACKAGE","url":"https://github.com/dfinity/cdk-rs"},{"type":"WEB","url":"https://github.com/dfinity/cdk-rs/security/advisories/GHSA-rwq6-crjg-9cpw"},{"type":"WEB","url":"https://github.com/dfinity/cdk-rs/commit/bd17d57a7b8ca59665fea5fad6143ca02724d03b"},{"type":"WEB","url":"https://docs.rs/ic-cdk/latest/ic_cdk"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0372.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:48.759546072Z"}}