Description
llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with a length above std::vector::max_size(), triggering an uncaught std::length_error that aborts the process and denies service to all clients.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ggml-org llama.cpp
Default version status: unaffected
b2877 to < b11935affected
pkg:github/ggml-org/llama.cppReferences
- https://github.com/ggml-org/llama.cpp/pull/31204 ↗
- https://github.com/ggml-org/llama.cpp/commit/7ecb57f7adbea2928aa468ad2aecf05b10725ad4 ↗
- https://github.com/ggml-org/llama.cpp ↗
- https://github.com/ggml-org/llama.cpp/releases/tag/b11935 ↗
- https://github.com/ggml-org/llama.cpp/blob/8542e94350f0ade01644db6f1d1520da3814dafd/ggml/src/ggml-rpc/ggml-rpc.cpp#L344-L356 ↗
- https://www.vulncheck.com/advisories/llama-cpp-b2877-before-b11935-ggml-rpc-server-dos-via-oversized-recv-msg-length ↗