High severity · published Apr 26, 2024
CVE-2024-32878
Use of Uninitialized Variable Vulnerability in llama.cpp
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. Causes llama.cpp to crash (DoS) and may even lead to arbitrary code execution (RCE). This vulnerability has been patched in commit b2740.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
llama.cpp · ggerganov
<= b2715 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32878
Release Notes
https://github.com/ggerganov/llama.cpp/releases/tag/b2749
Vendor Advisory
https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-p5mv-gjc5-mwqv
More from llama.cpp
9.8
CVE-2024-42479
llama.cpp allows write-what-where in rpc_server::set_tensor
9.8
CVE-2024-42478
llama.cpp allows Arbitrary Address Read in rpc_server::get_tensor
9.8
CVE-2024-21825
A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17
9.8
CVE-2024-23496
A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17
9.8
CVE-2024-21836
A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17