PT-2024-4657 · Ollama · Ollama
Akos Jakab
+1
·
Published
2024-05-05
·
Updated
2026-03-03
·
CVE-2024-37032
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ollama versions prior to 0.1.34
Description
Ollama has a flaw due to insufficient input validation, leading to a path traversal issue. This allows an attacker to overwrite arbitrary files on the server, potentially leading to remote code execution (RCE). Exploitation involved overwriting
/etc/ld.so.preload to load a malicious shared library, escalating from arbitrary file write to remote code execution. Over 1,000 instances were found to be exposed. The issue occurs because Ollama does not validate the format of the digest (SHA256 with 64 hexadecimal digits) when obtaining the model path, mishandling cases with fewer or more than 64 digits, or when the path begins with a ../ substring.Recommendations
Versions prior to 0.1.34 should be updated to version 0.1.34 or later.
Exploit
Fix
RCE
Path traversal
Relative Path Traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ollama