CVE-2024-42478: llama.cpp allows Arbitrary Address Read in rpc_server::get_tensor
Published Aug 12, 2024
·Updated
llama.cpp provides LLM inference in C/C++. The unsafe data pointer member in the rpctensor structure can cause arbitrary address reading. This vulnerability is fixed in b3561.
Affected Software
1 affected component
ggml llama.cpp<b3561
Remediation
Event History
Aug 12, 2024
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-42478?
The severity of CVE-2024-42478 has not been explicitly classified, but it poses a risk of arbitrary address reading which can lead to unauthorized data access.
2
How do I fix CVE-2024-42478?
CVE-2024-42478 can be fixed by updating Llama.cpp to version b3561 or later.
3
What is the impact of CVE-2024-42478?
CVE-2024-42478 allows for arbitrary address reading which can compromise the confidentiality of the data handled by the affected software.
4
Which versions of Llama.cpp are affected by CVE-2024-42478?
CVE-2024-42478 affects all versions of Llama.cpp prior to version b3561.
5
Is CVE-2024-42478 a coding or implementation issue?
CVE-2024-42478 is considered a coding issue due to unsafe handling of the `data` pointer in the `rpc_tensor` structure.