Inference infrastructure

CVE-2024-39722 affects Ollama before 0.1.46. A path traversal flaw in the api/push route lets a remote party see which files exist on the server where Ollama is deployed. The weakness is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

CVE-2024-39721 affects Ollama before 0.1.34. In the CreateModelHandler function, os.Open reads a file until completion, and the user-controlled req.Path parameter can be set to /dev/random, a blocking device. This causes the goroutine to run indefinitely, even after the client aborts the HTTP request. The weakness is classified as CWE-404, Improper Resource Shutdown or Release.

CVE-2024-39720 affects Ollama before 0.1.46. An attacker can upload a malformed GGUF file of just 4 bytes, starting with the GGUF custom magic header, using two HTTP requests. By pointing a custom Modelfile's FROM statement at that blob, the attacker crashes the application through the CreateModel route with a segmentation fault (SIGSEGV). The weakness is classified as CWE-125, Out-of-bounds Read.

CVE-2024-39719 affects Ollama through 0.3.14. Calling the CreateModel route through api/create with a nonexistent path parameter returns a "File does not exist" error message to the caller, letting an attacker determine whether files exist on the server. The weakness is classified as CWE-209, Generation of Error Message Containing Sensitive Information.

CVE-2024-8768 is a flaw in the vLLM library. A completions API request with an empty prompt crashes the vLLM API server, causing a denial of service. The weakness is classified as CWE-617, Reachable Assertion, and NVD had not yet provided an assessment when published on 09/17/2024.

CVE-2024-45436 affects extractFromZipFile in model.go in Ollama before 0.1.47. The flaw lets the function extract members of a ZIP archive outside the parent directory, which is classified as CWE-22 (Path Traversal). NVD has not yet provided an assessment.

CVE-2024-37032 affects Ollama before 0.1.34. The software does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, so it mishandles inputs such as digests with fewer or more than 64 hex digits or an initial ../ substring. The weakness is classified as CWE-22, Path Traversal, and was published to NVD on 05/31/2024.

CVE-2024-3924 is a code injection flaw in the `autodocs.yml` workflow file of the huggingface/text-generation-inference repository. The workflow builds a package-install command from the untrusted `github.head_ref` value, so an attacker who forks the repository, names a branch with a malicious payload, and opens a pull request to the base repository can achieve arbitrary code execution within the GitHub Actions runner. The issue affects versions up to and including v2.0.0.

CVE-2023-31036 affects NVIDIA Triton Inference Server for Linux and Windows when it is launched with the non-default command line option --model-control explicit. An attacker can use the model load API to cause a relative path traversal, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The source lists CWE-22 and CWE-23 and notes that NVD has not yet provided a CVSS assessment.