| --- |
| license: mit |
| tags: [security, poc, huntr, model-file-vulnerability] |
| --- |
| # PoC — koboldcpp legacy ggml loaders: unchecked `n_dims` → `ne[2]` stack buffer overflow |
| |
| huntr MFV PoC vs [`LostRuins/koboldcpp`](https://github.com/LostRuins/koboldcpp) `otherarch/*`. |
| Authorized security research (responsible disclosure via huntr). |
| |
| koboldcpp's legacy ggml loaders read a per-tensor `int32_t n_dims` from the model file and loop |
| `for (i=0;i<n_dims;++i) fin.read(&ne[i], ...)` into a fixed `int32_t ne[2]` — with no `n_dims<=2` check. |
| n_dims>=3 writes attacker-controlled bytes past the 2-element stack array (CWE-787). Present in gpt2_v1/ |
| v2/v3, gptj_v1/v2/v3, mpt_v3, llama_v2/v3, neox_v2/v3, rwkv_v2 (reached via FileFormat detection). |
| |
| ## Files |
| - `ndims_repro.cpp` / `CRASH_PROVEN.md` — isolated repro; EXC_BAD_ACCESS at the `ne[i]` store. |
| |
| ## Reproduce |
| ``` |
| c++ -O0 -g -fstack-protector-all ndims_repro.cpp -o ndims_repro && ./ndims_repro 100000 # -> SIGSEGV |
| ``` |
| ## Fix |
| Add `if (n_dims < 0 || n_dims > 2) return ModelLoadResult::FAIL;` before the ne-fill loop in each loader. |
| |
