CVE-2024-39720: Ollama Out-of-bounds Read
8.2
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.43837%
CWE
Published
10/31/2024
Updated
12/12/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/ollama/ollama | go | < 0.1.46 | 0.1.46 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability manifests in the CreateModel route handler (server/routes.go) where user-supplied GGUF files are processed. The GitHub advisory's diff link points to line 417 in routes.go, suggesting modifications to validation logic in this area. The OOB read occurs when parsing malformed GGUF files, implicating both the HTTP handler (failure to validate() input) and the low-level GGUF parser (lack of bounds checks). Confidence is high for CreateModelHandler due to direct route involvement, and medium for GGUF parsing functions due to indirect evidence from the vulnerability mechanics.