CVE-2024-39720

Vulnerability

Overview Ollama versions prior to 0.1.46 contain an out-of-bounds read vulnerability (CWE-125) in the handling of GGUF model files. An attacker can exploit this by sending two HTTP requests: first to upload a malformed GGUF file containing only 4 bytes starting with the custom magic header, and second to create a model using a Modelfile that references the attacker-controlled blob via a FROM statement. This triggers a segmentation fault (signal SIGSEGV) in the CreateModel route, resulting in a denial of service [1][2].

Exploitation

Conditions No authentication is required to trigger the vulnerability. The attacker only needs network access to an Ollama server. The exploit leverages the standard HTTP API endpoints used for uploading files and creating models. The root cause is insufficient validation of GGUF file contents before attempting to parse them, leading to an out-of-bounds read when the parser encounters the truncated data [1][2].

Impact

Successful exploitation causes the Ollama application to crash due to a segmentation violation. This constitutes a denial of service, making the AI model serving functionality unavailable until the service is manually restarted. The Ollama project is widely used in enterprise environments for local inference, and such crashes can disrupt productivity [1][3].

Mitigation

The vulnerability is patched in Ollama version 0.1.46. Users should upgrade to this version or later to prevent exploitation. There is no known workaround. The fix addresses the GGUF parsing logic to properly handle malformed files [4].