CVE-2024-4435: Ic stable structures Ic-stable-structures Vulnerable To BTreeMap Memory Vulnerability

MODERATE
Advisory Identifier: GHSA-3rcq-39xp-7xjp
Share
CVSS 5.9
CWE-401
Published
Advisory Summary

CVE-2024-4435 is a MODERATE (CVSS 5.9) ic-stable-structures vulnerable to btreemap memory vulnerability (CWE-401: Missing Release of Memory after Effective Lifetime) affecting Ic stable structures libraries in the crates.io ecosystem. The issue involves ic-stable-structures vulnerable to btreemap memory leak when deallocating nodes with overflows. Remediation is available by upgrading affected packages to version 0.6.4.

CVE-2024-4435 at a Glance

CVE Identifier CVE-2024-4435
GHSA Identifier GHSA-3rcq-39xp-7xjp
Severity MODERATE
CVSS v3.1 Base Score 5.9
CWE Classification CWE-401: Missing Release of Memory after Effective Lifetime
Affected Product Ic stable structures
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 5.9

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2024-4435

To remediate this vulnerability, upgrade all affected Ic stable structures dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

ic-stable-structures fixed: 0.6.4 
Upgrade ic-stable-structures to 0.6.4
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for ic-stable-structures

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-4435, inspect your project dependencies for Ic stable structures:

inspect dependencies for ic-stable-structures

Analyze the terminal output to locate any version of Ic stable structures in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.6.4), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-401: Missing Release of Memory after Effective Lifetime, where the product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. In Ic stable structures, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact When storing unbounded types in a `BTreeMap`, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain (incorrectly) allocated, causing a memory leak. In the worst case, depending on how a canister uses the `BTreeMap`, an adversary could interact with the canister through its API and trigger interactions with the map that keep consuming memory due to the memory leak. This could potentially lead to using an excessive amount of memory, or even running out of memory. This issue has been fixed in #212 by changing the logic for deallocating nodes to ensure that all of a node's memory chunks are deallocated. Tests have been added to prevent regressions of this nature moving forward. **Note:** Users of stable-structure < 0.6.0 are not affected. ### Patches The problem has been fixed in PR #212 and users are asked to upgrade to version `0.6.4`. ### Workarounds Users who are not storing unbounded types in `BTreeMap` are not affected and do not need to upgrade. Otherwise, an upgrade to version `0.6.4` is necessary.

CVE-2024-4435 Affected Ic stable structures Versions

1 component(s)
Fixed Versions:
0.6.4
Product / Package Ecosystem Affected Versions Fixed Version
ic-stable-structures
 crates.io
≥ 0.6.0
< 0.6.4
0.6.4

References

GitHub Advisory / Wiki ADVISORY
https://github.com/dfinity/stable-structures/security/advisories/GHSA-3rcq-39xp-7xjp
NVD — CVE-2024-4435 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4435
Ic stable structures Source Repository REPOSITORY
https://github.com/dfinity/stable-structures/pull/212
Security Fix Commit FIX COMMIT
https://github.com/dfinity/stable-structures/commit/4f6b8ae521884833498bae26369c353c10f28ea7
docs.rs/ic-stable-structure... WEB
https://docs.rs/ic-stable-structures/0.6.4/ic_stable_structures
Ic stable structures Source Repository REPOSITORY
https://github.com/dfinity/stable-structures
internetcomputer.org/docs/current/develo... WEB
https://internetcomputer.org/docs/current/developer-docs/smart-contracts/maintain/storage#stable-memory
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2024-0406.html

Frequently Asked Questions

What is CVE-2024-4435?
CVE-2024-4435 is a security vulnerability in Ic stable structures involving ic-stable-structures vulnerable to BTreeMap memory leak when deallocating nodes with overflows under CWE-401: Missing Release of Memory after Effective Lifetime.
Which Ic stable structures versions are affected?
Affected versions include releases prior to 0.6.4 across affected packages: ic-stable-structures.
What version fixes CVE-2024-4435?
Upgrading to 0.6.4 (or the latest patched release for your respective branch) resolves the vulnerability.
Is ic-stable-structures affected?
Yes, ic-stable-structures is affected in releases prior to 0.6.4. Upgrade your dependency to 0.6.4 or later.
What is the CVSS score of CVE-2024-4435?
CVE-2024-4435 has a CVSS v3.1 base score of 5.9 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2024-4435?
CVE-2024-4435 is classified under CWE-401: Missing Release of Memory after Effective Lifetime (The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.).
How can I check crates.io dependencies for CVE-2024-4435?
Run the dependency tree command: 'inspect dependencies for ic-stable-structures'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3rcq-39xp-7xjp",
  "modified" : "2025-12-10T18:45:24Z",
  "published" : "2024-05-21T14:49:48Z",
  "aliases" : [ "CVE-2024-4435" ],
  "summary" : "ic-stable-structures vulnerable to BTreeMap memory leak when deallocating nodes with overflows",
  "details" : "### Impact\nWhen storing unbounded types in a `BTreeMap`, a node is represented as a linked list of \"memory chunks\". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remain (incorrectly) allocated, causing a memory leak.\n\nIn the worst case, depending on how a canister uses the `BTreeMap`, an adversary could interact with the canister through its API and trigger interactions with the map that keep consuming memory due to the memory leak. This could potentially lead to using an excessive amount of memory, or even running out of memory. \n\nThis issue has been fixed in #212 by changing the logic for deallocating nodes to ensure that all of a node's memory chunks are deallocated. Tests have been added to prevent regressions of this nature moving forward.\n\n**Note:** Users of stable-structure < 0.6.0 are not affected.\n\n### Patches\nThe problem has been fixed in PR #212 and users are asked to upgrade to version `0.6.4`.\n\n### Workarounds\nUsers who are not storing unbounded types in `BTreeMap` are not affected and do not need to upgrade. Otherwise, an upgrade to version `0.6.4` is necessary.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "ic-stable-structures"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.6.0"
      }, {
        "fixed" : "0.6.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/dfinity/stable-structures/security/advisories/GHSA-3rcq-39xp-7xjp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-4435"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dfinity/stable-structures/pull/212"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dfinity/stable-structures/commit/4f6b8ae521884833498bae26369c353c10f28ea7"
  }, {
    "type" : "WEB",
    "url" : "https://docs.rs/ic-stable-structures/0.6.4/ic_stable_structures"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dfinity/stable-structures"
  }, {
    "type" : "WEB",
    "url" : "https://internetcomputer.org/docs/current/developer-docs/smart-contracts/maintain/storage#stable-memory"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2024-0406.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-401" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-05-21T14:49:48Z",
    "nvd_published_at" : "2024-05-21T10:15:10Z"
  }
}