CVE-2023-6245
📋 TL;DR
The Candid library vulnerability allows attackers to cause Denial of Service by sending specially crafted payloads that trigger infinite decoding loops in Rust-based canisters. This affects Internet Computer canisters using vulnerable versions of the Candid library, potentially degrading performance or causing execution traps. Motoko-based canisters are unaffected.
💻 Affected Systems
- Candid library for Rust
- Internet Computer canisters using Candid
📦 What is this software?
Candid by Dfinity
⚠️ Risk & Real-World Impact
Worst Case
Canister becomes completely unresponsive due to infinite decoding loops, causing persistent denial of service and potential resource exhaustion.
Likely Case
Degraded canister performance with repeated payload exposure, leading to instruction limit traps and service disruption.
If Mitigated
Minimal impact with patched versions or proper input validation in place.
🎯 Exploit Status
Exploit requires sending specially crafted Candid payloads to vulnerable canisters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Candid library with PR #478 applied
Vendor Advisory: https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j
Restart Required: Yes
Instructions:
1. Update Candid dependency to patched version. 2. Rebuild and redeploy affected canisters. 3. Verify the fix by testing with malicious payloads.
🔧 Temporary Workarounds
Input validation filter
allImplement custom input validation to reject payloads containing 'empty' type in unexpected positions
🧯 If You Can't Patch
- Implement rate limiting on canister calls to reduce impact of repeated attacks
- Deploy canister monitoring to detect abnormal instruction consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check Candid library version in Cargo.toml or lock file against patched versionsCheck Version:
grep -i candid Cargo.toml || grep candid Cargo.lockVerify Fix Applied:
Test canister with payload 'record { * ; empty }' against expected type 'record { * }' - should not cause infinite loop📡 Detection & Monitoring
Log Indicators:
- Canister traps due to instruction limit exceeded
- Abnormally long decoding times
Network Indicators:
- Repeated calls with similar payload patterns
- Unusually large number of canister calls from single source
SIEM Query:
canister_trap_reason:"instruction limit" AND canister_language:"rust"🔗 References
- https://github.com/dfinity/candid/blob/master/spec/Candid.md
- https://github.com/dfinity/candid/pull/478
- https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j
- https://internetcomputer.org/docs/current/references/candid-ref
- https://internetcomputer.org/docs/current/references/ic-interface-spec
- https://github.com/dfinity/candid/blob/master/spec/Candid.md
- https://github.com/dfinity/candid/pull/478
- https://github.com/dfinity/candid/security/advisories/GHSA-7787-p7x6-fq3j
- https://internetcomputer.org/docs/current/references/candid-ref
- https://internetcomputer.org/docs/current/references/ic-interface-spec
