Heap Out-of-Bounds Write in llama.cpp GGUF Model Loading

Executive Summary

This vulnerability is a heap out-of-bounds write issue in the PLaMo-2 tokenizer of the llama.cpp library. It occurs when parsing byte tokens in GGUF models. The function `llm_tokenizer_plamo2::build` converts hex strings to integers without validating the range. Attackers can craft tokens like <0x-1> to write before the bytes_ buffer, causing heap corruption. This leads to crashes or potential code execution during model loading.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of llama.cpp in use. Run: `llama-server --version` or inspect the installed package version. If the version is between b5899 and b10260, the system is vulnerable. Additionally, monitor for crashes during model loading, especially with GGUF files.

Useful 0 Not Useful 0

Impact Analysis

If you use vulnerable versions of llama.cpp (b5899 to b10260), loading a malicious GGUF model could crash your application or allow arbitrary code execution. This could compromise system integrity, confidentiality, or availability. The attack requires only loading a crafted model, which may come from public model registries.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade llama.cpp to version b10261 or later. This can be done via package managers or by compiling from source. Avoid loading untrusted GGUF models until the update is applied. Remove or quarantine any suspicious models that may trigger the vulnerability.

Useful 0 Not Useful 0