llama.cpp provides LLM inference in C/C++.
Date: 2024-08
Affected: ggml/llama.cpp
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-41130
CVE-2024-42477
CVE-2024-42478
CVE-2024-42479
CWE: CWE-123
CWE-125
CWE-401
CWE-476
CWE-787
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561.


Mitigations:

Architectural layers (MAESTRO):