CVE-2024-21825: Heap-Based Buffer Overflow Vulnerability in GGUF Library Leads to Code Execution through Malicious .gguf Files

Recently, a heap-based buffer overflow vulnerability has been identified in the GGUF library (CVE-2024-21825). This library is widely used in various software applications to handle GGUF_TYPE_ARRAY and GGUF_TYPE_STRING. The vulnerability exists in the llama.cpp Commit 18c2e17 and can lead to code execution if a specially crafted .gguf file is provided by an attacker. In this post, we will discuss the specifics of this vulnerability, how it can be exploited, and how to mitigate this risk.

Vulnerability Details

The heap-based buffer overflow vulnerability arises due to improper handling of GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality in the llama.cpp file in Commit 18c2e17 of the GGUF library. Attackers can create a crafted .gguf file that, when parsed by the vulnerable function, leads to a buffer overflow on the heap. This can lead to code execution—an attacker can execute arbitrary malicious code on the target system with the privileges of the user running the vulnerable application.

The flawed code snippet in the llama.cpp file is as follows

// llama.cpp - Commit 18c2e17
// ...
void parseGGUFFile(const char *filename) {
    // ...
    for (size_t i = ; i < size; ++i) {
        if (gguf_type == GGUF_TYPE_ARRAY || gguf_type == GGUF_TYPE_STRING) {
            // ... Code that doesn't validate input size ...
            buffer[offset++] = data[i]; // Heap buffer overflow
            // ...
        }
    }
    // ...
}

As evident in the snippet, the buffer allocation and copying of data from a malformed .gguf file is not properly handled with input validation. This oversight can lead to a heap-based buffer overflow and potential code execution by an attacker.

Exploit Development

To exploit this vulnerability, an attacker can create a malicious .gguf file that contains a specially crafted GGUF_TYPE_ARRAY or GGUF_TYPE_STRING. When parsed by the vulnerable function, it leads to a buffer overflow, which can then be exploited to execute arbitrary code. A detailed explanation of how this crafted file can be generated and the process of exploiting the vulnerability is available in the original advisory, linked in the References section below.

Mitigation

To mitigate this vulnerability, developers are advised to apply a patch to their implementation of the GGUF library that addresses this issue. The patch includes proper validation of GGUF_TYPE_ARRAY and GGUF_TYPE_STRING input sizes and prevents heap buffer overflows. Users of software applications that depend on the GGUF library should update their application when a security update is available.

Conclusion

The heap-based buffer overflow vulnerability in the GGUF library (CVE-2024-21825) is a significant risk that requires attention from both developers and users. By understanding the root cause of the vulnerability, as well as how it can be exploited, developers can better protect their software against this threat, and users can adopt appropriate measures to safeguard their systems from potential attacks.

References

1. CVE-2024-21825 - Heap-based Buffer Overflow in GGUF Library - Vulnerability Advisory
2. GGUF Library Project - Repository and Patch Information
3. Exploiting Buffer Overflows - Techniques and Examples

Timeline

Published on: 02/26/2024 16:27:55 UTC
Last modified on: 02/26/2024 18:15:07 UTC