CVE-2024-8063

Executive Summary

CVE-2024-8063 is a high-severity (CVSS 7.5) denial-of-service vulnerability affecting Ollama v0.3.3. The flaw resides in the GGUF model import functionality, where a crafted block_count value in the Modelfile triggers a divide-by-zero error. This causes the Ollama server process to crash, leading to service unavailability. No public exploit code or patch is currently available. The vulnerability is classified under CWE-369 (Divide By Zero) and aligns with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for exposed Ollama instances.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) – No special conditions required beyond sending a crafted model.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The crash does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Service crash leads to denial of service.

Threat Level: High. While no active exploitation is reported, the vulnerability is trivial to trigger and can cause immediate service disruption.

Deep Dive & Mechanics

The vulnerability exists in the GGUF model import routine within Ollama. When a user imports a model via a Modelfile, the server parses the model metadata, including block_count. If an attacker crafts a Modelfile where block_count is set to zero, the server performs a division operation using this value as a divisor. In C/C++ (the likely implementation language), division by zero results in undefined behavior, typically causing a SIGFPE signal and process termination.

The attack vector is simple: an attacker with network access to the Ollama API can send a POST request to the model import endpoint with a malicious Modelfile. The server crashes immediately upon processing, denying service to legitimate users.

Vulnerable vs. Patched Code

Vulnerable Code (v0.3.3):

// Hypothetical vulnerable code snippet
int block_count = get_block_count_from_modelfile();
int result = some_value / block_count; // Division by zero if block_count == 0

Patched Code (Hypothetical):

// Patched code with zero check
int block_count = get_block_count_from_modelfile();
if (block_count == 0) {
    return error("Invalid block_count: must be non-zero");
}
int result = some_value / block_count;

No official patch has been released. The fix should include input validation to reject zero values for block_count.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to an Ollama server (default port 11434).
• Ability to send HTTP POST requests.

Exploitation Steps:

1. Craft a malicious Modelfile with block_count set to 0.
2. Send a POST request to /api/create with the Modelfile content.
3. The server crashes, causing a denial of service.

Example Request:

curl -X POST http://target:11434/api/create \
  -H "Content-Type: application/json" \
  -d '{"name": "malicious-model", "modelfile": "FROM llama2\nPARAMETER block_count 0"}'

Expected Outcome: The Ollama server process terminates, and subsequent requests fail.

Blue Team

Detection:

• Monitor for rapid server restarts or crashes.
• Alert on HTTP 500 errors or connection resets from the Ollama API.
• Log analysis for requests containing block_count 0 in the Modelfile.

Mitigation:

• Restrict network access to the Ollama API (firewall rules).
• Implement input validation at the reverse proxy level (e.g., Nginx) to block requests with block_count 0.
• Deploy a Web Application Firewall (WAF) with custom rules to detect malicious Modelfiles.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/create with block_count 0 in the body.
• System: Ollama server process crash logs containing SIGFPE or division-by-zero errors.
• File: Modelfiles with block_count 0 in transit or on disk.
• Behavior: Repeated server restarts or unavailability of the Ollama service.

Detection Engineering

YARA Rule

rule CVE_2024_8063_Ollama_Divide_By_Zero {
    meta:
        description = "Detects malicious Modelfiles targeting CVE-2024-8063"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-8063"
    strings:
        $block_count = "block_count" nocase
        $zero = "0" ascii
    condition:
        $block_count and $zero and filesize < 10KB
}

Sigma Rule

title: Ollama Divide by Zero DoS Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to Ollama API with block_count set to 0
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/create'
        cs-body|contains: 'block_count 0'
    condition: selection
falsepositives:
    - Legitimate testing with zero block_count (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-8063 Ollama Divide by Zero DoS Attempt";
    flow:to_server;
    content:"POST"; http_method;
    content:"/api/create"; http_uri;
    content:"block_count 0"; http_client_body;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Ollama servers from untrusted networks.
2. Implement input validation at the application or proxy layer to reject block_count values of zero.
3. Monitor for crash events and anomalous API requests.

Long-Term Fix:

• Await an official patch from Ollama. Until then, consider using a fork or custom build with the zero-check fix.
• Upgrade to a patched version once released.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter requests containing block_count 0:

location /api/create {
    if ($request_body ~* "block_count 0") {
        return 403;
    }
    proxy_pass http://ollama_backend;
}

Valters IT
DevSecOps & Cyber Threat Intelligence