Listen to this Post
The vulnerability occurs in the mlx::core::load_gguf() function when processing a maliciously crafted GGUF file. The function `extract_tensor_data()` receives a `gguf_tensor` structure from the external `gguflib` library. This structure contains a `weights_data` pointer and a `num_weights` value, both controlled by the input file. The code passes these values directly to `memcpy` without validating if the `weights_data` pointer is non-null. When a file provides a null or invalid `weights_data` pointer, the `memcpy` attempts to read from this invalid memory address, causing a segmentation fault and crashing the application. This crash is unrecoverable and cannot be caught by C++ exception handlers, leading to a denial-of-service.
Platform: MLX
Version: Pre-patch
Vulnerability: NULL Pointer Dereference
Severity: Critical
date: 2024-11-21
Prediction: 2024-12-05
What Undercode Say:
pip install mlx
python3 -c "import mlx.core as mx; mx.load('exploit.gguf', format='gguf')"
clang -fsanitize=address fuzz_load_gguf.cpp
./a.out
//Vulnerable Code (gguf.cpp:64-67) memcpy( buffer.raw_ptr(), tensor->weights_data, // Untrusted, potentially NULL tensor->num_weights equivalent_dtype.value().size());
How Exploit:
Craft malicious GGUF file.
Set tensor->weights_data to NULL.
Call mx.load(‘malicious.gguf’).
Application crashes immediately.
Protection from this CVE
Validate tensor->weights_data pointer.
Apply proposed code fix.
Use fuzzing for detection.
Sanitize GGUF inputs.
Impact:
Denial-of-Service
Application Crash
Uncatchable Segmentation Fault
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
