Sign In
Advisories

llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

Go Back
severity
high
date
Affecting

  • llama.cpp >= b1283, <= b9058

  • llama.cpp >= 0.4.0, <= 0.17.1

CWE
  • CWE-190 Integer Overflow or Wraparound
  • CWE-680 Integer Overflow to Buffer Overflow
CVSS
8.5
CVSS V4 Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
Vladimir Tokarev (@G1ND1L4) - Vulnerability Research Tech Lead, Cyera, Ofek Itach (@ofekitach) - Security Research Team Lead, Cyera
Description
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo