Lucene search

GitHub_MCVE-2024-42479

HistoryAug 12, 2024 - 3:15 p.m.

CVE-2024-42479

2024-08-1215:15:21

CWE-787

CWE-123

GitHub_M

web.nvd.nist.gov

llama.cpp rpc_tensor data pointer vulnerability arbitrary address writing fixed b3561

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

38.0%

JSON

llama.cpp provides LLM inference in C/C++. The unsafe data pointer member in the rpc_tensor structure can cause arbitrary address writing. This vulnerability is fixed in b3561.

Affected configurations

Nvd

Vulnrichment

Node

ggerganovllama.cppRange<b3561

VendorProductVersionCPE
ggerganovllama.cpp*cpe:2.3:a:ggerganov:llama.cpp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ggerganov	llama.cpp	*	cpe:2.3:a:ggerganov:llama.cpp::::::::

CNA Affected

[
  {
    "vendor": "ggerganov",
    "product": "llama.cpp",
    "versions": [
      {
        "version": "< b3561",
        "status": "affected"
      }
    ]
  }
]

References

github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b

github.com/ggerganov/llama.cpp/security/advisories/GHSA-wcr5-566p-9cwj

Social References

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

38.0%

JSON

Related for CVE-2024-42479