CVE-2024-7884

When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture allows multiple references to be held for this internal state and not all references were dropped before the Future is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. Impact Canisters built in Rust with ic_cdk and ic_cdk_timers are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. In the worst case, this could lead to heap memory exhaustion triggered by an attacker. Motoko based canisters are not affected by the bug. PatchesThe patch has been backported to all minor versions between >= 0.8.0, <= 0.15.0. The patched versions available are 0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1 and their previous versions have been yanked. WorkaroundsThere are no known workarounds at the moment. Developers are recommended to upgrade their canister as soon as possible to the latest available patched version of ic_cdk to avoid running out of Wasm heap memory. Upgrading the canisters (without updating `ic_cdk`) also frees the leaked memory but it's only a temporary solution.

• CWE-401
• CWE-401

• https://docs.rs/ic-cdk/latest/ic_cdk/Product
• https://github.com/dfinity/cdk-rs/pull/509Issue Tracking, Patch
• https://internetcomputer.org/docs/current/references/ic-interface-specProduct

Published

Sep 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7878The WP ULike WordPress plugin before 4.7.4 does not sanitis…4.8
• CVE-2024-7879The WP ULike WordPress plugin before 4.7.5 does not sanitis…4.8
• CVE-2024-7880Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-7881An unprivileged context can trigger a data memory-dependent …5.1
• CVE-2024-7882Improper Neutralization of Special Elements used in an SQL C…6.5
• CVE-2024-7883When using Arm Cortex-M Security Extensions (CMSE), Secure s…3.7
• CVE-2024-7885A vulnerability was found in Undertow where the ProxyProtoco…7.5
• CVE-2024-7886A vulnerability has been found in Scooter Software Beyond Co…8.5
• CVE-2024-7887A vulnerability was found in LimeSurvey 6.3.0-231016 and cla…4.9
• CVE-2024-7888The Classified Listing – Classified ads & Business Directory…4.3
• CVE-2024-7889Local privilege escalation allows a low-privileged user to g…7.3
• CVE-2024-7890Local privilege escalation allows a low-privileged user to g…7.3