PT-2024-29974 · Llama.Cpp · Llama.Cpp

7Resp4Ss · Published 2024-08-12 · Updated 2024-11-23 · CVE-2024-42478

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b3561

Description The issue is related to the rpc tensor structure in llama.cpp, which provides LLM inference in C/C++. The data pointer member in this structure is unsafe, allowing for arbitrary address reading.

Recommendations For versions prior to b3561, update to b3561 or later to resolve the issue. As a temporary workaround, consider restricting access to the rpc tensor structure to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-42478

GHSA-5VM9-P64X-GQW9

Affected Products

Llama.Cpp

References · 18

• 🔥 https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-5vm9-p64x-gqw9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42478.json · Exploit
• https://github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42478 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42478 · Vendor Advisory
• https://twitter.com/0x_shaq/status/1842066022544670723 · Twitter Post
• https://twitter.com/_r_netsec/status/1841998694201360734 · Twitter Post
• https://t.me/cvenotify/90740 · Telegram Post
• https://twitter.com/hackyboiz/status/1860232420538351962 · Twitter Post
• https://t.me/secharvester/17290 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823020605081305301 · Twitter Post
• https://t.me/defcon_news/125857 · Telegram Post
• https://twitter.com/Dinosn/status/1842060870068690972 · Twitter Post
• https://twitter.com/CVEnew/status/1823019694586290477 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1823037495220601158 · Twitter Post