CVE-2024-37032
📋 TL;DR
This vulnerability in Ollama allows attackers to bypass path validation when retrieving model files, potentially leading to arbitrary file read or remote code execution. It affects all Ollama installations running versions before 0.1.34. The issue stems from improper validation of SHA256 digest format in model path handling.
💻 Affected Systems
- Ollama
📦 What is this software?
Ollama by Ollama
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through path traversal leading to full system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Arbitrary file read allowing access to sensitive configuration files, model data, or system information.
If Mitigated
Limited impact with proper network segmentation and minimal privileges, potentially only affecting isolated model storage.
🎯 Exploit Status
Proof of concept available in public references; exploitation requires minimal technical skill due to lack of authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.34
Vendor Advisory: https://github.com/ollama/ollama/releases/tag/v0.1.34
Restart Required: Yes
Instructions:
1. Stop Ollama service. 2. Download and install Ollama 0.1.34 or later from official releases. 3. Restart Ollama service. 4. Verify version with 'ollama --version'.
🔧 Temporary Workarounds
Network Restriction
linuxRestrict network access to Ollama instances using firewall rules
sudo ufw deny from any to any port 11434
sudo iptables -A INPUT -p tcp --dport 11434 -j DROP
Service Isolation
allRun Ollama in isolated container or VM with minimal privileges
docker run --rm -it -p 11434:11434 ollama/ollama:0.1.34
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Ollama instances from untrusted networks
- Run Ollama with minimal system privileges and in read-only filesystem mode where possible
🔍 How to Verify
Check if Vulnerable:
Check Ollama version: if version is less than 0.1.34, system is vulnerableCheck Version:
ollama --versionVerify Fix Applied:
Verify version is 0.1.34 or higher and test path validation with malformed digest inputs📡 Detection & Monitoring
Log Indicators:
- Unusual model path requests with non-standard digest formats
- Failed path validation attempts
- Access to files outside expected model directories
Network Indicators:
- HTTP requests to Ollama API with malformed digest parameters
- Unusual traffic patterns to port 11434
SIEM Query:
source="ollama.log" AND ("../" OR "digest" AND NOT "sha256:[a-f0-9]{64}")🔗 References
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58
- https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34
- https://github.com/ollama/ollama/pull/4175
- https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58
- https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34
- https://github.com/ollama/ollama/pull/4175
- https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032
