Invia #997844: Tiiny-AI PowerInfer up to main commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 Out-of-Bounds (CWE-125)

A vulnerability was found in PowerInfer up to main commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 (no tagged releases, last push 2026-05-11) and classified as high 7.1. Affected is the GGUF model loading component (the llama_model_loader and the GGUF parser it uses). The manipulation of the GGUF tensor data offset fields (the header data_offset and the per-tensor offset) leads to an out-of-bounds read. The attack is launched locally: the victim has to run PowerInfer inference on an attacker-supplied model file in the GGUF format, which is the standard distribution form of model files in this ecosystem.

Technical Details
- Affected file/function, verified at main commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4: ggml.c:19465 (gguf_init_from_file) validates each tensor entry only against the type block size (ne % blck_size, ggml.c:19658-19665) and performs no offset/size validation. llama.cpp:2123 (file_offset()) returns gguf_get_data_offset() + gguf_get_tensor_offset() — two file-controlled fields summed with no containment check. llama.cpp:2129-2130 (load_data_for(), default mmap path) assigns cur->data = mapping->addr + offs with no check that offs + ggml_nbytes(cur) stays within the file or the mapping. The non-mmap branch (llama.cpp:2131-2133) fails closed via read_raw; the default path does not. The default is mmap (common/common.h:123, use_mmap = true).
- Vulnerable parameter: the GGUF header data_offset and per-tensor offset fields of a model file supplied to the loader
- Attack vector: Local
- Privileges required: None
- Trigger condition: loading a crafted GGUF v3 file with default flags (mmap path). The crafted file passes parsing and loading without any error or warning; the out-of-bounds access surfaces only when the tensor data is consumed, as either a silent read of unrelated process memory or a crash (SEGV / ASan heap-buffer-overflow READ on far offsets).
- Origin of the weakness: the loader layer is inherited from the llama.cpp lineage, where this primitive was already identified and fixed upstream; a copy of the fixed loader ships inside this repository itself (smallthinker/src/llama-model-loader.h:41-45), which validates offs + ggml_nbytes(tensor) against file->size() and throws "tensor '%s' data is not within the file bounds, model is corrupted or incomplete". The main loader in llama.cpp predates that hardening, so this is a resync case rather than a novel 0-day.
- Validation: dynamic validation at harness grade — the offset arithmetic and mmap pointer assignment (llama.cpp:2123, :2129-2130) executed verbatim with the repository's own GGUF parser (gguf_init_from_file, ggml.c:19465) compiled unmodified to parse the fixtures, in an offline container (Debian, clang 19.1.7, AddressSanitizer). Six cases passed, twice, byte-identical: a benign control reading back the file's real bytes; three silent out-of-bounds reads demonstrated with harmless sentinel filler (mapping tail, adjacent mapping, 1 TiB displacement); and two crash cases (ASan heap-buffer-overflow READ; SEGV on a non-canonical offset). Not executed: the full llama_model_loader translation unit against a real model file descriptor, the complete application entry chain, the GPU/CUDA stack, and a real victim process address space layout — the exact bytes disclosed next to a model mapping in a production run were not demonstrated. Fixtures differed from the benign control by a single header field; no exploit artifact was produced or attached.

Impact
- Confidentiality: High (the out-of-bounds read discloses process memory adjacent to or unrelated to the model mapping — demonstrated reading sentinel content placed outside the file, including across mappings and at a 1 TiB displacement — and the read bytes become tensor data used by the model)
- Integrity: None (the primitive is read-only; no write was demonstrated or claimed)
- Availability: High (far or unmapped offsets crash the loading process: ASan heap-buffer-overflow READ and SEGV were both reproduced deterministically)

CVSS v3.1
Score: 7.1 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Timeline
- Discovered: 2026-09-19 (static audit; dynamic harness validation completed the same day)
- Vendor notified: 2026-09-24 (issue <NUM> opened; mechanism only, no payload attached)
- Patch released: [pending]
- Public disclosure: 2026-09-24 (issue <NUM> published; exploit not released)

Countermeasure
Port the file-bounds containment check into the main GGUF loader (file_offset / load_data_for, llama.cpp:2116-2135): after computing offs, reject the model when offs + ggml_nbytes(tensor) overflows or exceeds the file size — the exact check already present in this repository's own vendored copy (smallthinker/src/llama-model-loader.h:41-45) and in current llama.cpp. Until a fix is released, only run PowerInfer inference on model files from trusted sources, or load with --no-mmap (the non-mmap branch fails closed).

• Fonte: ⚠️ https://github.com/Tiiny-AI/PowerInfer/issues/283
• Utente: dem0000 (UID 98390)
• Sottomissione: 24/09/2026 17:23 (30 giorni fa)
• Moderazione: 11/10/2026 21:11 (17 days later)
• Stato: Accettato
• Voce VulDB: 416774 [Tiiny-AI PowerInfer fino a 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 GGUF Parser ggml.c gguf_init_from_file data_offset rivelazione di informazioni]
• Punti: 20