References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Change History

https://github.com/ggerganov/llama.cpp/releases/tag/b2749

https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-p5mv-gjc5-mwqv

Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. Causes llama.cpp to crash (DoS) and may even lead to arbitrary code execution (RCE). This vulnerabili

GitHub, Inc. AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

GitHub, Inc. CWE-456

GitHub, Inc. https://github.com/ggerganov/llama.cpp/releases/tag/b2749 [No types assigned]

GitHub, Inc. https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-p5mv-gjc5-mwqv [No types assigned]