{"vulnerability": "CVE-2024-7884", "sightings": [{"uuid": "bd490528-9e4e-43ae-816c-4134d3690eeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-7884", "type": "seen", "source": "https://t.me/cvedetector/4916", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-7884 - IC Canister ic_cdk Memory Leak\", \n  \"Content\": \"CVE ID : CVE-2024-7884 \nPublished : Sept. 5, 2024, 1:15 p.m. | 41\u00a0minutes ago \nDescription : When a canister method is called via ic_cdk::call* , a new Future CallFuture\u00a0is created  and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState.  A bug in the polling implementation of the CallFuture allows multiple references to be held for this internal state and not all references were dropped before the Future\u00a0is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak.   \nImpact\u00a0Canisters built in Rust with ic_cdk\u00a0and ic_cdk_timers\u00a0are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. In the worst case, this could lead to heap memory exhaustion triggered by an attacker. Motoko based canisters are not affected by the bug.  \nPatchesThe patch has been backported to all minor versions between >= 0.8.0, Severity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-05T16:22:19.000000Z"}]}