CVE-2024-11991
Medium
Description
Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the Canister to enable the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko.
SeverityMedium
CVSS5.6
Exploit probability—
ProductDfinity Motoko
PublishedDec 9, 2024
First seenDec 9, 2024
Weakness typeCWE-908CWE-908
How to fix
Update
- dfinity motoko0.13.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dfinity motoko | 0.9.0 ≤ v < 0.13.4 | 0.13.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.