CVE Vulnerabilities

CVE-2024-42479

Write-what-where Condition

Published: Aug 12, 2024 | Modified: Aug 15, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

llama.cpp provides LLM inference in C/C++. The unsafe data pointer member in the rpc_tensor structure can cause arbitrary address writing. This vulnerability is fixed in b3561.

Weakness

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

Affected Software

Name Vendor Start Version End Version
Llama.cpp Ggerganov * b3561 (excluding)

Potential Mitigations

References