« Volver al listado

CVE-2023-6245

Estado: ModificadaAlta (7.5)—

The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as an extra field required by the type. The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable error when skipping the field and thus causing an infinite decoding loop.

Canisters using affected versions of candid are exposed to denial of service by causing the decoding to run indefinitely until the canister traps due to reaching maximum instruction limit per execution round.

Leer descripción completaMostrar menos

Repeated exposure to the payload will result in degraded performance of the canister. Note: Canisters written in Motoko are unaffected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dfinity — Candid

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6245",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-6245",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-02T14:31:05.379872Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b",
      "affectedData": [
        {
          "repo": "https://github.com/dfinity/candid",
          "vendor": "Internet Computer",
          "product": "Candid",
          "versions": [
            {
              "status": "affected",
              "version": "0.9.0",
              "lessThan": "0.9.10",
              "versionType": "0.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-08T15:15:08.233",
  "references": [
    {
      "url": "https://github.com/dfinity/candid/blob/master/spec/Candid.md",
      "tags": [
        "Product"
      ],
      "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b"
    },
    {
      "url": "https://github.com/dfinity/candid/pull/478",
      "tags": [
        "Patch"
      ],
      "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b"
    },
    {
      "url": "https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b"
    },
    {
      "url": "https://internetcomputer.org/docs/current/references/candid-ref",
      "tags": [
        "Product"
      ],
      "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b"
    },
    {
      "url": "https://internetcomputer.org/docs/current/references/ic-interface-spec",
      "tags": [
        "Product"
      ],
      "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b"
    },
    {
      "url": "https://github.com/dfinity/candid/blob/master/spec/Candid.md",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/dfinity/candid/pull/478",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://internetcomputer.org/docs/current/references/candid-ref",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://internetcomputer.org/docs/current/references/ic-interface-spec",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b35d637-e00f-4228-858c-b20ad6e1d07b",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-168"
        },
        {
          "lang": "en",
          "value": "CWE-835"
        },
        {
          "lang": "en",
          "value": "CWE-1288"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Candid library causes a Denial of Service while \nparsing a specially crafted payload with 'empty' data type. For example,\n if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as an extra field required by the type.  The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable error when skipping the field and thus causing an infinite decoding loop.\n\n\nCanisters using affected versions of candid\n are exposed to denial of service by causing the decoding to run \nindefinitely until the canister traps due to reaching maximum \ninstruction limit per execution round. Repeated exposure to the payload \nwill result in degraded performance of the canister. Note: Canisters written in Motoko are unaffected.\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "La librería Candid provoca una denegación de servicio mientras analiza un payload especialmente manipulado con un tipo de datos \"vacío\". Por ejemplo, si el payload es `record { * ; empty }` y la interfaz del recipiente espera `record { * }`, entonces el decodificador sincero de Rust trata el vacío como un campo adicional requerido por el tipo. El problema con el tipo vacío es que la sincera librería Rust clasifica erróneamente vacío como un error recuperable al omitir el campo y, por lo tanto, provoca un bucle de decodificación infinito. Los contenedores que utilizan versiones afectadas de candid están expuestos a una denegación de servicio al hacer que la decodificación se ejecute indefinidamente hasta que el contenedor se bloquea debido a que alcanza el límite máximo de instrucciones por ronda de ejecución. La exposición repetida a el payload dará como resultado un rendimiento degradado del recipiente. Nota: Los botes escritos en Motoko no se ven afectados."
    }
  ],
  "lastModified": "2026-06-17T06:50:23.063",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dfinity:candid:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F95D6602-30FA-4473-9660-F87B18A446FD",
              "versionEndExcluding": "0.9.10",
              "versionStartIncluding": "0.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "6b35d637-e00f-4228-858c-b20ad6e1d07b"
}