Bug 2358011 - Possible RCE in llama-cpp on Fedora 42
Summary: Possible RCE in llama-cpp on Fedora 42
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: llama-cpp
Version: 42
Hardware: Unspecified
OS: Linux
unspecified
urgent
Target Milestone: ---
Assignee: Tom.Rix
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-07 18:21 UTC by Marco Benatto
Modified: 2025-04-20 04:22 UTC (History)
2 users (show)

Fixed In Version: llama-cpp-b4094-11.fc42
Clone Of:
Environment:
Last Closed: 2025-04-20 04:22:22 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Marco Benatto 2025-04-07 18:21:27 UTC
Hello,

we have received a heads-up about a security flaw in llama-cpp upstream, the security flaw is a RCE in llama-cpp RPC mechanism which were reported on:

https://retr0.blog/blog/llama-rpc-rce

Looking at the project's GitHub security advisory page at:
https://github.com/ggml-org/llama.cpp/security

I see there's no advisory nor CVE reported for this, however there's a upstream commit mentioning the RCE and containing a fix:

https://github.com/ggml-org/llama.cpp/commit/1d20e53c40c3cc848ba2b95f5bf7c075eeec8b19

The commit above was included firstly on b4657 tag:

$ git tag --contains 1d20e53c40c3cc848ba2b95f5bf7c075eeec8b19 | head -10
b4657
b4658
b4659
b4660
b4661
b4662
b4663
b4666
b4667
b4671

Looking at latest llama-cpp build on Koji it seems it's on b4580 tag:

https://koji.fedoraproject.org/koji/buildinfo?buildID=2675105

built on last March 9th which doesn't currently have the commit.

Reproducible: Always

Comment 1 Fedora Update System 2025-04-10 12:25:46 UTC
FEDORA-2025-b356588c06 (llama-cpp-b4094-11.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-b356588c06

Comment 2 Fedora Update System 2025-04-11 02:11:42 UTC
FEDORA-2025-b356588c06 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-b356588c06`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-b356588c06

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Fedora Update System 2025-04-20 04:22:22 UTC
FEDORA-2025-b356588c06 (llama-cpp-b4094-11.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.