llama.cpp RPC Server Arbitrary Write
- Product
- ggml llama.cpp
- CVE
- CVE-2024-42479
- Disclosed
- 2024-08-12
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- llama.cpp < b3561 (rpc-server)
- Fixed
- b3561
Summary
llama.cpp's distributed-inference RPC server trusted a raw memory pointer sent by clients. Anyone who could reach the port could write to arbitrary memory addresses, a write-what-where primitive leading to code execution.
Root cause
The rpc_tensor structure sent over the network carries a 'data' pointer that the server used directly in set_tensor/copy operations without validating it against the allocated buffer. A malicious client can point it at arbitrary process memory and overwrite it with attacker data.
Impact
Unauthenticated memory corruption and remote code execution on hosts running rpc-server.
Detection
Identify llama.cpp builds older than b3561 with rpc-server listening on the network (default port 50052).
Mitigation
Upgrade to b3561 or later and never expose rpc-server outside a trusted network.