Infinite decoding loop through specially crafted payload

CVE-2023-6245

Summary

The Candid library has a vulnerability that leads to Denial of Service when processing malicious payloads that include an 'empty' data type. In scenarios where the payload is structured as 'record { * ; empty }' while the expected format is 'record { * }', the Rust candid decoder misinterprets the empty type as an obligatory field. This misclassification forces the decoder into an infinite loop while attempting to rectify the error, leading to prolonged execution times until the system reaches its instruction limit. Continuous exposure to such crafted payloads severely impacts canister performance, resulting in frequent service disruptions for affected applications. Note that canisters developed in Motoko remain unaffected by this issue.

References