| शीर्षक | EricLBuehler mistral.rs (mistralrs-core) 0.8.1 / HEAD eb31bf3 Out-of-bounds Read |
|---|
| विवरण | mistral.rs reads the GGUF metadata key tokenizer.ggml.eos_token_id (the end-of-sequence token id)
directly from an untrusted model file and uses it as an index into the vocabulary array without any
bounds check. In mistralrs-core/src/gguf/gguf_tokenizer.rs at line 143, convert_gguf_to_hf_tokenizer()
evaluates props.tokens[props.eos as usize]. A crafted GGUF file that declares eos_token_id = 4294967295
(u32::MAX) together with a single-token vocabulary drives an out-of-bounds array index. Rust's bounds
check turns this into a deterministic panic (SIGABRT) during model load. Because eos_token_id is required
on the embedded-tokenizer path, the indexing site is always reached for such a GGUF, so the crash is
reliable rather than probabilistic.
Impact: denial of service (process abort) for any application that loads an attacker-supplied GGUF model
through mistral.rs. This is an out-of-bounds-index panic, not memory corruption or code execution.
Attack vector: an attacker supplies or substitutes a GGUF model file (model supply chain / local file);
loading it aborts the process. CWE-125 (Out-of-bounds Read). Proposed CVSS 7.5
(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Status: the underlying issue was subsequently fixed upstream by pull request #2282; it remains a valid,
publicly-referenced vulnerability for cataloguing. Confirmed present at finding time (0.8.1) and
source-revalidated against HEAD eb31bf3 (2026-06-14). Reported via public issue #2225. |
|---|
| स्रोत | ⚠️ https://github.com/EricLBuehler/mistral.rs/issues/2225 |
|---|
| उपयोगकर्ता | m00dy (UID 97162) |
|---|
| सबमिशन | 01/07/2026 10:37 PM (2 महीनों पहले) |
|---|
| संयम | 17/08/2026 06:36 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 391327 [EricLBuehler Mistral.rs तक 0.8.22 GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer eos_token_id/bos_token_id/unknown_token_id सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|