CVE-2024-23605 in GGUF
Summary
by MITRE • 02/26/2024
A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/13/2025
The heap-based buffer overflow vulnerability identified as CVE-2024-23605 resides within the GGUF library header.n_kv functionality of the llama.cpp project, specifically in commit 18c2e17. This vulnerability represents a critical security flaw that can be exploited through manipulation of .gguf file format structures, which are commonly used for storing machine learning model parameters and metadata. The GGUF format serves as a standardized container for large language models and other neural network architectures, making this vulnerability particularly concerning given the widespread adoption of llama.cpp and similar frameworks in both research and production environments. The vulnerability stems from inadequate input validation and memory management within the header.n_kv parsing mechanism that processes key-value pairs stored in these model files.
The technical flaw manifests when the GGUF library processes malformed key-value entries in the header section of .gguf files. During parsing operations, the library fails to properly validate the size and structure of incoming data, leading to a situation where heap memory allocation does not account for potentially malicious input sizes. When an attacker crafts a specially designed .gguf file containing oversized or malformed key-value pairs, the parsing function attempts to allocate insufficient heap memory for the data, resulting in a buffer overflow condition. This overflow allows arbitrary data to overwrite adjacent memory locations, potentially corrupting program state or enabling code execution. The vulnerability operates at the intersection of memory safety issues and format parsing errors, making it particularly challenging to detect and prevent through conventional security measures.
The operational impact of this vulnerability extends beyond simple privilege escalation or denial of service scenarios, as it provides a direct path to remote code execution within applications that utilize the vulnerable llama.cpp library. Attackers can leverage this vulnerability by distributing malicious .gguf files through various attack vectors including compromised software repositories, phishing campaigns, or supply chain attacks targeting machine learning model distribution platforms. The exploitability is heightened because .gguf files are commonly used in automated model loading processes, meaning that simply opening or processing a malicious file could trigger the vulnerability without user interaction. This makes the attack surface particularly broad across applications that integrate llama.cpp functionality, including AI development tools, model serving platforms, and research environments where model files are frequently exchanged and processed.
Mitigation strategies for CVE-2024-23605 should focus on immediate patching of the vulnerable llama.cpp library to address the buffer overflow in the header.n_kv parsing functionality. Organizations should implement strict input validation measures for all GGUF file processing, including size limits and format compliance checks that prevent oversized key-value pairs from being processed. The implementation of address space layout randomization ASLR and stack canaries can provide additional defense-in-depth measures to make exploitation more difficult. Furthermore, organizations should consider implementing automated file scanning systems that can detect potentially malicious GGUF file structures before they are processed by vulnerable applications. Security monitoring should include detection of unusual memory allocation patterns and heap operations that may indicate exploitation attempts. This vulnerability aligns with CWE-121 heap-based buffer overflow and represents a significant concern under ATT&CK tactic TA0002 (Execution) and technique T1059.001 (Command and Scripting Interpreter), as it enables attackers to execute arbitrary code through legitimate application interfaces that process machine learning model files.