| 标题 | EricLBuehler mistral.rs (mistralrs-core) 0.8.1 / HEAD eb31bf3 Out-of-bounds Read |
|---|
| 描述 | mistral.rs reads the GGUF metadata key tokenizer.ggml.eos_token_id (the end-of-sequence token id)
directly from an untrusted model file and uses it as an index into the vocabulary array without any
bounds check. In mistralrs-core/src/gguf/gguf_tokenizer.rs at line 143, convert_gguf_to_hf_tokenizer()
evaluates props.tokens[props.eos as usize]. A crafted GGUF file that declares eos_token_id = 4294967295
(u32::MAX) together with a single-token vocabulary drives an out-of-bounds array index. Rust's bounds
check turns this into a deterministic panic (SIGABRT) during model load. Because eos_token_id is required
on the embedded-tokenizer path, the indexing site is always reached for such a GGUF, so the crash is
reliable rather than probabilistic.
Impact: denial of service (process abort) for any application that loads an attacker-supplied GGUF model
through mistral.rs. This is an out-of-bounds-index panic, not memory corruption or code execution.
Attack vector: an attacker supplies or substitutes a GGUF model file (model supply chain / local file);
loading it aborts the process. CWE-125 (Out-of-bounds Read). Proposed CVSS 7.5
(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Status: the underlying issue was subsequently fixed upstream by pull request #2282; it remains a valid,
publicly-referenced vulnerability for cataloguing. Confirmed present at finding time (0.8.1) and
source-revalidated against HEAD eb31bf3 (2026-06-14). Reported via public issue #2225. |
|---|
| 来源 | ⚠️ https://github.com/EricLBuehler/mistral.rs/issues/2225 |
|---|
| 用户 | m00dy (UID 97162) |
|---|
| 提交 | 2026-07-01 22時37分 (2 月前) |
|---|
| 管理 | 2026-08-17 18時36分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 391327 [EricLBuehler Mistral.rs 直到 0.8.22 GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer eos_token_id/bos_token_id/unknown_token_id 信息公开] |
|---|
| 积分 | 20 |
|---|