CVE-2024-12886: Out-Of-Memory (OOM) Vulnerability in ollama/ollama
An Out-Of-Memory (OOM) vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing. The vulnerability is present in the makeRequestWithRetry and getAuthorizationToken functions, which use io.ReadAll to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ollama/ollamato a version that resolves this vulnerability.Fixed in 0.3.14 - Compensating control
Mitigate DoS risk by blocking or restricting connections from untrusted/malicious upstream API servers that could return gzip-bomb HTTP responses to the ollama server.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12886?
CVE-2024-12886 is classified as a high-severity vulnerability due to its potential to crash the `ollama` server.
How do I fix CVE-2024-12886?
To mitigate CVE-2024-12886, upgrade the `ollama` server to a version newer than 0.3.14 where the vulnerability has been addressed.
What type of vulnerability is CVE-2024-12886?
CVE-2024-12886 is an Out-Of-Memory (OOM) vulnerability that can be triggered by malicious HTTP responses.
Which versions of `ollama` are affected by CVE-2024-12886?
CVE-2024-12886 affects `ollama` server version 0.3.14 and earlier.
What happens if CVE-2024-12886 is exploited?
Exploitation of CVE-2024-12886 can lead to the `ollama` server crashing, resulting in denial of service.