PT-2024-29975 · Llama.Cpp · Llama.Cpp

7Resp4Ss

·

Published

2024-08-12

·

Updated

2024-11-23

·

CVE-2024-42479

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b3561
Description The issue is related to the rpc tensor structure in llama.cpp, which provides LLM inference in C/C++. The unsafe data pointer member can cause arbitrary address writing, potentially leading to remote code execution if exploited. Millions of devices may be exposed to this risk.
Recommendations For versions prior to b3561, update the library to b3561 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the rpc tensor structure or disabling the data pointer member until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787CWE-123

Related Identifiers

CVE-2024-42479
GHSA-WCR5-566P-9CWJ

Affected Products

Llama.Cpp