Out-of-Bounds Read in Whisper.cpp via log_mel_spectrogram

Executive Summary

This vulnerability is a heap out-of-bounds read in the log_mel_spectrogram function of the whisper.cpp library. It occurs when processing very short audio inputs with fewer than 201 samples. The function attempts to apply reflective padding by copying the first 200 samples in reverse, but if the input is too short, this operation reads beyond the allocated memory, causing an out-of-bounds read.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor applications using whisper.cpp for crashes or memory corruption when processing short audio inputs. Use AddressSanitizer (ASan) to detect out-of-bounds reads by compiling whisper.cpp with -fsanitize=address and feeding it short audio files (e.g., 16-byte inputs). Check logs for heap-buffer-overflow errors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker with local access to cause a denial-of-service or potentially leak sensitive information by triggering an out-of-bounds read in the whisper.cpp library. It may affect applications using whisper.cpp for audio transcription, especially those accepting user-supplied audio inputs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves an out-of-bounds read in audio processing, which could lead to memory corruption or crashes. While not directly impacting GDPR or HIPAA compliance, such vulnerabilities may expose systems to unauthorized data access or processing errors, potentially violating data integrity and security requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the pending patch from pull request #3925 to reject audio inputs shorter than 201 samples. Temporarily filter or reject short audio files in your application before passing them to whisper_full(). Monitor for crashes or memory corruption in whisper.cpp-based services.

Useful 0 Not Useful 0