llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes `ggml_nbytes` to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.
oryginał ENCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HGgml Llama.cpp
APPGgml< b7824
Powiązane podatności
RCE w llama.cpp — brak walidacji granic w RPC backend (deserialization)
Zapis pod dowolny adres pamięci w llama.cpp poprzez wskaźnik rpc_tensor
llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the gguf_init_from_file_impl() in gg...
llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parame...
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsign...