Vulnerability Description
An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely (even after the HTTP request is aborted by the client).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ollama | Ollama | < 0.1.34 |
Related Weaknesses (CWE)
References
- https://github.com/ollama/ollama/blob/9164b0161bcb24e543cba835a8863b80af2c0c21/sProduct
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/sProduct
- https://www.oligo.security/blog/more-models-more-probllmsExploitThird Party Advisory
FAQ
What is CVE-2024-39721?
CVE-2024-39721 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, ...
How severe is CVE-2024-39721?
CVE-2024-39721 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-39721?
Check the references section above for vendor advisories and patch information. Affected products include: Ollama Ollama.