Missing Release of Memory after Effective Lifetime Affecting ic-cdk package, versions >=0.8.0 <0.8.2 >=0.9.0 <0.9.3 >=0.10.0 <0.10.1 >=0.11.0 <0.11.5 >=0.12.0 <0.12.2 >=0.13.0 <0.13.4 >=0.14.0 <0.14.1 >=0.15.0 <0.15.1
Threat Intelligence
EPSS
0.05% (20th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-ICCDK-7920568
- published 6 Sep 2024
- disclosed 5 Sep 2024
- credit Adam Spofford
Introduced: 5 Sep 2024
CVE-2024-7884 Open this link in a new tabHow to fix?
Upgrade ic-cdk to version 0.8.2, 0.9.3, 0.10.1, 0.11.5, 0.12.2, 0.13.4, 0.14.1, 0.15.1 or higher.
Overview
ic-cdk is a Canister Developer Kit for the Internet Computer.
Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime through the ic_cdk::call method. An attacker can trigger heap memory exhaustion by repeatedly invoking this method, leading to uncontrolled memory allocation.