Out-of-Bounds Read in llama.cpp GGUF Model Loader

Executive Summary

CVE-2024-58399 is an out-of-bounds read vulnerability in llama.cpp before version b2731. It occurs in the llama_model_loader component when processing GGUF model files. The issue arises because the loader does not verify if tensor data is fully contained within the file before accessing it via memory-mapped files (mmap). Attackers can exploit this by providing a crafted or truncated GGUF file with arbitrary tensor offsets, causing the application to read memory outside the intended model file boundaries. This can lead to crashes or loading adjacent process memory as model weights.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or segmentation faults when loading GGUF model files in llama.cpp versions before b2731. Check for error codes like -1073741819 (0xC0000005) which indicate access violations. Validate model file integrity before processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact users by causing application crashes when processing corrupted or incomplete GGUF model files. It may lead to denial-of-service conditions or expose sensitive memory contents if adjacent process memory is loaded as model weights. Users relying on memory-mapped files for model loading are particularly affected, especially in environments where file integrity checks are insufficient.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to llama.cpp version b2731 or later which includes the fix for tensor offset validation. Ensure all GGUF model files are complete and not truncated before loading. Implement file integrity checks during download and storage.

Useful 0 Not Useful 0