CVE-2023-6245

What it actually does

The candid Rust decoder misclassifies the 'empty' type as a recoverable error when skipping an unexpected field in a record payload, resulting in an infinite decoding loop that consumes the instruction limit and traps the canister.

Why it matters to the business

Canisters experience repeated denial of service, leading to degraded availability, performance impact, and potential operational disruption for services relying on the affected library; the issue has been public for over two years with no change in exploit likelihood.

How an attack unfolds

An attacker crafts a record payload containing an 'empty' field that the target canister interface does not expect, submits it via the canister's ingress interface, and triggers the infinite loop in the candid decoder until the instruction limit is reached; repeated submissions sustain the degradation.

How to fix it

Upgrade the candid dependency to a patched release once available; in the interim implement strict input validation or schema enforcement at the canister boundary to reject unexpected record fields before decoding.

How to confirm the fix worked

Test the canister with both the malicious record { * ; empty } payload and a benign record to confirm the loop no longer occurs; verify the candid crate version in Cargo.lock and re-run unit tests that exercise record decoding.

Typical attack path

1. Identify a canister whose interface declares a record type without the 'empty' variant
2. Construct a malicious payload using the record { * ; empty } pattern
3. Submit the payload through the canister's public entry point or query method
4. Observe the decoder enter an infinite loop consuming the round's instruction budget
5. Repeat submissions to maintain degraded performance

How to detect it

Review canister execution logs for repeated instruction-limit traps during decoding operations; correlate spikes in failed or long-running ingress messages with payloads containing unexpected record fields.

What your security team should do

• Prioritize upgrade of the candid dependency as soon as a fixed version is released
• Add defensive schema checks or custom deserialization guards around record decoding
• Monitor canister instruction consumption metrics for anomalous spikes
• Restrict or rate-limit untrusted ingress traffic to affected entry points until patched