PT-2024-29973 · Llama.Cpp · Llama.Cpp

7Resp4Ss · Published 2024-08-12 · Updated 2026-04-27 · CVE-2024-42477

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions llama.cpp version b3561 and earlier

Description The issue arises from the unsafe type member in the rpc tensor structure, which can cause a global-buffer-overflow. This may lead to memory data leakage.

Recommendations For versions prior to b3561, update to b3561 or later to resolve the issue. As a temporary workaround, consider restricting access to the rpc tensor structure until a patch is available.

Exploit

Fix

Memory Leak

Out of bounds Read

Weakness Enumeration

CWE-401

CWE-125

Related Identifiers

CVE-2024-42477

GHSA-MQP6-7PV6-FQJF

Affected Products

Llama.Cpp

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42477.json · Exploit
• https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-mqp6-7pv6-fqjf · Vendor Advisory
• https://github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42477 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42477 · Vendor Advisory
• https://t.me/cvedetector/2845 · Telegram Post
• https://t.me/cveNotify/161125 · Telegram Post
• https://twitter.com/CVEnew/status/1823019695794192573 · Twitter Post
• https://twitter.com/hackyboiz/status/1860232420538351962 · Twitter Post
• https://t.me/cvenotify/90739 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823020606448652556 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1823036989156819027 · Twitter Post