Lucene search

GitHub_MCVE-2024-42477

HistoryAug 12, 2024 - 3:15 p.m.

CVE-2024-42477

2024-08-1215:15:21

CWE-401

CWE-125

GitHub_M

web.nvd.nist.gov

llama.cpp

llm inference

rpc_tensor

global buffer overflow

memory data leakage

b3561

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

llama.cpp provides LLM inference in C/C++. The unsafe type member in the rpc_tensor structure can cause global-buffer-overflow. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561.

Affected configurations

Nvd

Vulnrichment

Node

ggerganovllama.cppRange<b3561

VendorProductVersionCPE
ggerganovllama.cpp*cpe:2.3:a:ggerganov:llama.cpp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ggerganov	llama.cpp	*	cpe:2.3:a:ggerganov:llama.cpp::::::::

CNA Affected

[
  {
    "vendor": "ggerganov",
    "product": "llama.cpp",
    "versions": [
      {
        "version": "< b3561",
        "status": "affected"
      }
    ]
  }
]

References

github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b

github.com/ggerganov/llama.cpp/security/advisories/GHSA-mqp6-7pv6-fqjf

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-42477