Bug in ic_cdk Leads to Memory Leak in Rust Canisters

CVE-2024-7884

Summary

This vulnerability arises when a canister method utilizing ic_cdk::call* triggers the creation of a CallFuture, which allows the execution result to be awaited by the caller. The internal Future state, tracked by CallFutureState, can inadvertently retain multiple references due to flaws in the polling implementation. As a result, unaccounted references remain, leading to the internal state being stored inadvertently in the canister's heap, thereby causing a memory leak. Rust canisters using ic_cdk and ic_cdk_timers that initiate canister method calls, utilize timers, or heartbeat functionality are susceptible to minor memory leakage with every operation, potentially resulting in heap memory exhaustion. It's crucial to upgrade to the patched versions 0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, and 0.15.1 to mitigate this issue effectively, as there are currently no known workarounds.

References