CVE-2023-6245

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Improper Input Validation pada dfinity candid. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as an extra field required by the type. The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable error when skipping the field and thus causing an infinite decoding loop. Canisters using affected versions of candid are exposed to denial of service by causing the decoding to run indefinitely until the canister traps due to reaching maximum instruction limit per execution round. Repeated exposure to the payload will result in degraded performance of the canister. Note: Canisters written in Motoko are unaffected.

Rincian

Terbit di NVD

8 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-168: Improper Handling of Inconsistent Special Elements
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-1288: Improper Validation of Consistency within Input

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dfinity/candid/pull/478 patch
• https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j patch · advisory pihak ketiga
• https://github.com/dfinity/candid/blob/master/spec/Candid.md product
• https://internetcomputer.org/docs/current/references/candid-ref product
• https://internetcomputer.org/docs/current/references/ic-interface-spec product