| Título | ggml-org llama.cpp master bec4772f6 Memory Corruption |
|---|
| Descripción | The ggml-rpc server in llama.cpp (ggml/src/ggml-rpc/ggml-rpc.cpp) deserializes tensor fields, including the operation type (op) and operation parameters (op_params), directly from untrusted network data in deserialize_tensor() without validating them. On current master the copy is unchanged: result->op = (ggml_op) tensor->op and result->op_params[i] = tensor->op_params[i], with no range check on op and no rejection of custom operations.
When a remote client sends a tensor whose op is GGML_OP_CUSTOM (90) or GGML_OP_MAP_CUSTOM1/2/3 (87/88/89), ggml reinterprets op_params as a structure holding a function pointer (ggml_custom_op_t) and a userdata pointer, both fully attacker-controlled. During graph execution (ggml_backend_graph_compute -> ggml_compute_forward_custom) the server copies op_params into that structure and calls the embedded function pointer with attacker-controlled arguments. This gives a remote attacker control of the call target and its arguments, i.e. the ability to divert execution to an arbitrary address (control-flow hijack / potential remote code execution). A proof of concept demonstrates instruction-pointer control by directing the call to a marker address (0x4141414141414141), producing a crash at that address; full weaponization would substitute a valid target aided by the heap-address oracle below.
The ggml-rpc protocol has no authentication or encryption. Any client able to reach the RPC port (default TCP 50052) can trigger this with two packets: a HELLO handshake followed by a single GRAPH_COMPUTE message carrying the crafted tensor (the tensor must have GGML_TENSOR_FLAG_COMPUTE set). The ALLOC_BUFFER command returns raw heap addresses, providing an oracle that assists ASLR bypass.
This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params; the function-pointer vector remains unpatched. Verified by source inspection of current upstream master (commit bec4772f6, 2026-07-07): deserialize_tensor still copies op/op_params without validation and no custom-op rejection has landed. Weakness class CWE-502 (Deserialization of Untrusted Data) with CWE-749 (Exposed Dangerous Method or Function).
Suggested fix: in deserialize_tensor(), reject tensors whose op is GGML_OP_CUSTOM or GGML_OP_MAP_CUSTOM1/2/3 (these ops embed process-local function pointers meaningless across an RPC boundary), and reject any op >= GGML_OP_COUNT.
Affected: all llama.cpp versions with ggml-rpc support, up to and including current master (bec4772f6). No fix available.
Note that there is a previously assigned CVE of the same type/severity (not same thing):
https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-j8rj-fmpv-wcxw |
|---|
| Fuente | ⚠️ https://github.com/ggml-org/llama.cpp/issues/25289 |
|---|
| Usuario | m00dy (UID 97162) |
|---|
| Sumisión | 2026-07-08 01:09 (hace 2 meses) |
|---|
| Moderación | 2026-08-23 08:39 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 394534 [ggml-org llama.cpp bec4772f6 ggml-RPC Server ggml-rpc.cpp deserialize_tensor op/op_params escalada de privilegios] |
|---|
| Puntos | 20 |
|---|