CVE-2024-11991CWE-908

Uninitialized memory access in Motoko incremental garbage collector

Medium · published December 9, 2024

CVSS v3.1
5.6
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the Canister to enable the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2024-12-09T14:38Z
EPSS history
Timeline
  • 09 DEC 14:38Z
    Uninitialized memory access in Motoko incremental garbage collector
    cvelistv5