CVE-2024-39720: High severity Ollama Ollama vulnerability
An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/ollama/ollamato a version that resolves this vulnerability.Fixed in 0.1.46
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39720?
The severity of CVE-2024-39720 has not been assigned a CVSS score, but it is considered a significant vulnerability due to potential unauthorized code execution.
How do I fix CVE-2024-39720?
To fix CVE-2024-39720, upgrade to Ollama version 0.1.46 or later.
What software is affected by CVE-2024-39720?
CVE-2024-39720 affects Ollama versions prior to 0.1.46.
What type of attack is possible with CVE-2024-39720?
CVE-2024-39720 allows an attacker to upload a malformed GGUF file through crafted HTTP requests.
What are the potential impacts of CVE-2024-39720?
The potential impacts of CVE-2024-39720 include the execution of malicious code and unauthorized access to system resources.