提交 #882535: ggml-org llama.cpp master bec4772f6 Denial of Service

The ggml-rpc server in llama.cpp (ggml/src/ggml-rpc/ggml-rpc.cpp) is vulnerable to an unauthenticated remote NULL pointer dereference (denial of service) when reconstructing a compute graph from a GRAPH_COMPUTE (command 10) message.

In rpc_server::graph_compute(), each graph node is resolved from a client-supplied 64-bit node ID via create_node(). The RPC protocol uses ID 0 as a "not set" sentinel, for which create_node() returns a null pointer. The server explicitly allows this: it only rejects a null result when the ID is non-zero (if (graph->nodes[i] == nullptr && id != 0) return false;), so an ID of 0 leaves a NULL entry in graph->nodes[i] and the graph is still passed to ggml_backend_graph_compute().

During CPU compute planning, ggml_graph_plan() iterates the graph nodes and calls ggml_get_n_tasks(node) with no null check; ggml_get_n_tasks() calls ggml_is_empty(node), which unconditionally dereferences node->ne[i]. With node == NULL this dereferences a null pointer at offset 88 (offsetof(ggml_tensor, ne)), causing a crash. On a UBSan build this is reported as "member access within null pointer of type struct ggml_tensor"; on a production Linux x86_64 build it reliably triggers SIGSEGV, terminating the RPC server process.

The ggml-rpc protocol has no authentication. Any client that can reach the RPC port (default TCP 50052) can crash the server with a single crafted GRAPH_COMPUTE message containing a node with ID 0; a 20-byte payload is sufficient.

Verified by source inspection of current upstream master (commit bec4772f6, 2026-07-07): graph_compute still admits an id=0 null node into the compute graph (only non-zero-id failures are rejected), and the compute path (ggml_graph_plan -> ggml_get_n_tasks -> ggml_is_empty) has no null guard. The path is unpatched. Weakness class: CWE-476 (NULL Pointer Dereference).

Suggested fix: in rpc_server::graph_compute(), reject any graph that contains a null node (treat an id=0 node as a protocol error), or add a null guard in ggml_graph_plan()/ggml_get_n_tasks() before dereferencing each node.

Affected: all llama.cpp versions with ggml-rpc support, up to and including current master (bec4772f6). No fix available.

• 来源: ⚠️ https://github.com/ggml-org/llama.cpp/issues/25299
• 用户: m00dy (UID 97162)
• 提交: 2026-07-08 01時21分 (2 月前)
• 管理: 2026-08-23 08時39分 (2 months later)
• 状态: 已接受
• VulDB条目: 394535 [ggml-org llama.cpp bec4772f6 ggml-RPC Server ggml-rpc.cpp graph_compute 拒绝服务]
• 积分: 20