File size: 890 Bytes
3600bce | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 | # koboldcpp Legacy GGML Loader PoC
## Vulnerability
CWE-121 Stack Buffer Overflow + CWE-190 Integer Overflow in all 10 legacy model loaders.
## Target
LostRuins/koboldcpp - otherarch/*.cpp
## Usage
```
python3 generate_poc.py
```
This generates:
- poc_stack_oob.bin - triggers stack buffer overflow via n_dims=8 on ne[2]
- poc_int_overflow.bin - triggers integer overflow via n_embd=46341
## Reproduction
```
make LLAMA_SANITIZE_ADDRESS=1
./koboldcpp --model poc_stack_oob.bin
```
ASan will report stack-buffer-overflow in the ne[2] write loop.
## Affected Files
All share identical vulnerable pattern (int32_t ne[2] with unbounded n_dims loop):
- otherarch/gpt2_v1.cpp
- otherarch/gpt2_v2.cpp
- otherarch/gpt2_v3.cpp
- otherarch/gptj_v1.cpp
- otherarch/gptj_v2.cpp
- otherarch/gptj_v3.cpp
- otherarch/neox_v2.cpp
- otherarch/neox_v3.cpp
- otherarch/mpt_v3.cpp
- otherarch/rwkv_v2.cpp
|