CVE-2024-4435: Dfinity Stable Structures DoS Vulnerability

CVE-2024-4435 Overview

CVE-2024-4435 is a memory leak vulnerability in the Dfinity stable-structures Rust crate used by Internet Computer canisters. The flaw occurs when storing unbounded types in a BTreeMap, where nodes are represented as linked lists of memory chunks. When a node is deallocated, only the first chunk is released while the remaining chunks remain allocated. An adversary interacting with a vulnerable canister through its API can repeatedly trigger map operations that consume memory indefinitely. This can exhaust canister memory and cause denial of service.

Critical Impact
Remote attackers can exhaust canister memory through normal API interactions, leading to availability loss on Internet Computer smart contracts using stable-structures versions 0.6.0 through 0.6.3.

Affected Products

Dfinity stable-structures versions 0.6.0 through 0.6.3 (Rust crate)
Internet Computer canisters storing unbounded types in BTreeMap
Applications depending on ic-stable-structures prior to 0.6.4

Discovery Timeline

2024-05-21 - CVE-2024-4435 published to NVD
2025-12-10 - Last updated in NVD database

Technical Details for CVE-2024-4435

Vulnerability Analysis

The stable-structures crate provides stable-memory data structures for Internet Computer canisters written in Rust. When developers store unbounded types in a BTreeMap, the library stores each node as a linked list of fixed-size memory chunks because the value size is not known at compile time. The deallocation routine for these nodes contained a logic error that released only the head chunk of the chain. The trailing chunks remained marked as allocated in the stable memory allocator, even though the node was logically removed.

Each insert and remove cycle against the map leaks the chunks beyond the first one. Repeated invocations of canister API methods that mutate the map cause cumulative growth of allocated-but-unreachable memory. This category of defect is tracked as a memory leak weakness under [CWE-401].

Root Cause

The root cause lives in the node-deallocation logic for unbounded-value nodes inside the BTreeMap implementation. The function returned after freeing the first chunk without traversing and freeing the remaining chunks in the linked list. The fix delivered in GitHub pull request #212 walks the full chunk chain and releases every chunk before the node is considered freed. Regression tests were added to lock in the corrected behavior.

Attack Vector

Exploitation requires no authentication or user interaction. An attacker invokes public canister methods that insert and remove entries containing unbounded values in the affected BTreeMap. Each operation leaks memory chunks. Sustained calls drive the canister toward its stable-memory limit until allocations fail or the canister becomes unresponsive. The attack is network-reachable through standard Internet Computer ingress messages.

No verified public proof-of-concept exploit code is available. Refer to the IC Stable Structures Documentation and Internet Computer Storage Guide for technical context.

Detection Methods for CVE-2024-4435

Indicators of Compromise

Steady growth in canister stable-memory usage that does not correlate with the logical size of stored data.
Sustained high-frequency calls to canister methods that mutate BTreeMap entries containing unbounded values.
Canister trap or out of memory errors during write operations on BTreeMap instances.

Detection Strategies

Inventory Rust dependencies and flag any project pinned to ic-stable-structures or stable-structures versions 0.6.0 through 0.6.3.
Audit canister source code to identify BTreeMap instances that store unbounded value types such as Vec<u8> or String without Storable::BOUND set to Bounded.
Compare reported stable-memory consumption against the expected size derived from current map cardinality and entry sizes.

Monitoring Recommendations

Track stable-memory growth rates per canister and alert on monotonic increases that exceed the rate of legitimate data ingestion.
Log and rate-limit external calls to BTreeMap mutation endpoints to detect abusive call patterns.
Include dependency version checks in continuous integration pipelines to catch downstream consumers of vulnerable releases.

How to Mitigate CVE-2024-4435

Immediate Actions Required

Upgrade ic-stable-structures to version 0.6.4 or later in all affected Rust canisters and redeploy.
Confirm whether any production canister stores unbounded types in BTreeMap; only those workloads are exposed.
Review canister cycle and memory budgets to ensure sufficient headroom during the upgrade window.

Patch Information

The fix is included in stable-structures version 0.6.4 through GitHub pull request #212. The patched deallocation routine traverses every memory chunk in a node's chain and releases each one. Regression tests were added to prevent reintroduction of the defect. Users on versions earlier than 0.6.0 are not affected.

Workarounds

Restrict map values to bounded types by implementing Storable with BOUND = Bounded { max_size, is_fixed_size }, which avoids the chunked node representation entirely.
Where feasible, replace affected BTreeMap instances with alternative stable-memory structures that do not rely on chunked node storage.
Apply application-level rate limits on canister methods that mutate vulnerable maps until the patched version is deployed.

bash

# Update Cargo.toml to the patched version
# [dependencies]
# ic-stable-structures = "0.6.4"

cargo update -p ic-stable-structures --precise 0.6.4
cargo build --release --target wasm32-unknown-unknown
dfx deploy --network ic