CVE-2024-42477
📋 TL;DR
CVE-2024-42477 is a global buffer overflow vulnerability in llama.cpp's rpc_tensor structure that can lead to memory data leakage. This affects users running vulnerable versions of llama.cpp for LLM inference. The vulnerability allows reading beyond allocated memory boundaries, potentially exposing sensitive information.
💻 Affected Systems
- llama.cpp
📦 What is this software?
Llama.cpp by Ggerganov
⚠️ Risk & Real-World Impact
Worst Case
Memory data leakage could expose sensitive model data, user inputs, or system memory contents, potentially leading to information disclosure or as a stepping stone for further attacks.
Likely Case
Information disclosure through memory leakage, potentially exposing fragments of model parameters or inference data.
If Mitigated
Limited impact with proper memory isolation and sandboxing, though some information leakage may still occur.
🎯 Exploit Status
Exploitation requires triggering the specific buffer overflow condition through the rpc_tensor interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit b3561 or later
Vendor Advisory: https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-mqp6-7pv6-fqjf
Restart Required: Yes
Instructions:
Update to commit b3561 or later
Pull latest changes: git pull origin master
Rebuild: make clean && make
Restart any running llama.cpp instances
🔧 Temporary Workarounds
Disable RPC functionality
allDisable or restrict access to RPC features if not required
Configure llama.cpp without RPC support
Use firewall rules to block RPC ports
🧯 If You Can't Patch
- Isolate llama.cpp instances in containers with limited memory access
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check git commit hash: git log --oneline -1 | grep -v b3561Check Version:
git log --oneline -1Verify Fix Applied:
Verify commit is b3561 or later: git log --oneline -1 | grep b3561📡 Detection & Monitoring
Log Indicators:
- Memory access violations
- Segmentation faults in llama.cpp processes
- Unusual memory usage patterns
Network Indicators:
- Unusual RPC traffic patterns
- Multiple failed RPC requests
SIEM Query:
process_name:"llama" AND (event_type:"segmentation_fault" OR memory_violation:"true")