CVE-2025-0312

Executive Summary

CVE-2025-0312 is a high-severity vulnerability (CVSS 7.5) affecting Ollama versions <=0.3.14. The flaw resides in the GGUF model file parsing logic, where a maliciously crafted model file can trigger an unchecked null pointer dereference. This leads to a Denial of Service (DoS) condition when the file is uploaded and processed by the Ollama server. The vulnerability is remotely exploitable over the network without authentication, making it a significant threat to availability. No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service.

Threat Level: High. The vulnerability is easy to exploit remotely, requires no authentication, and directly impacts service availability. The lack of a patch increases the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic null pointer dereference (CWE-476) in the GGUF model file parser. GGUF is a binary format used by Ollama to store and load machine learning models. When a user uploads a model file, the server parses the GGUF header and tensor data. A malicious actor can craft a GGUF file with a corrupted or missing pointer in the tensor metadata. When the parser attempts to dereference this pointer without validation, it results in a null pointer dereference, causing the server process to crash.

The crash is immediate and does not require any special conditions beyond the server accepting the file upload. Since the upload endpoint is typically exposed to the network, an attacker can repeatedly send malicious files to cause a sustained DoS.

Vulnerable vs. Patched Code

Vulnerable Code (<=0.3.14): The vulnerable code likely resides in the GGUF parser, where a pointer from the file is used directly without a null check. For example:

// Vulnerable: No null check before dereference
tensor_data = (float*)file_data + tensor_offset;
process_tensor(tensor_data);

Patched Code (Hypothetical): A patch would add a null check before dereferencing the pointer:

// Patched: Null check added
if (tensor_offset == NULL) {
    return error("Invalid tensor offset");
}
tensor_data = (float*)file_data + tensor_offset;
process_tensor(tensor_data);

Exploitation & Lab Setup

Red Team

1. Craft Malicious GGUF File: Create a GGUF file with a null pointer in the tensor metadata. This can be done by modifying a legitimate GGUF file using a hex editor or a custom script.
2. Upload to Ollama Server: Use curl or a similar tool to upload the malicious file to the Ollama API endpoint (e.g., /api/create).
3. Trigger Crash: The server will parse the file and crash due to the null pointer dereference.

Example Upload Command:

curl -X POST http://target:11434/api/create -H "Content-Type: application/json" -d '{"model": "malicious", "files": {"malicious.gguf": "@malicious.gguf"}}'

Blue Team

1. Monitor for Crashes: Set up monitoring on the Ollama server process to detect unexpected crashes.
2. File Integrity Checks: Implement checksums or signatures for uploaded GGUF files to detect tampering.
3. Network Segmentation: Restrict access to the Ollama API to trusted networks only.
4. Rate Limiting: Apply rate limiting on the upload endpoint to mitigate repeated DoS attempts.

Indicators of Compromise (IOCs)

• Network: Repeated upload requests to /api/create with large or malformed GGUF files.
• File: GGUF files with null pointers in tensor metadata (detectable via static analysis).
• System: Ollama server process crashes with segmentation fault (SIGSEGV) or null pointer dereference errors in logs.
• Logs: Error messages like "Segmentation fault" or "Null pointer dereference" in Ollama server logs.

Detection Engineering

YARA Rule

rule CVE_2025_0312_Null_Pointer_GGUF {
    meta:
        description = "Detects malicious GGUF files with null pointer dereference"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-0312"
    strings:
        $gguf_magic = { 47 47 55 46 } // "GGUF" magic bytes
        $null_offset = { 00 00 00 00 00 00 00 00 } // Potential null pointer
    condition:
        $gguf_magic at 0 and $null_offset
}

Sigma Rule

title: CVE-2025-0312 Ollama Null Pointer Dereference DoS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-0312 via Ollama server crashes
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ollama'
        CommandLine|contains: 'segfault'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0312 Ollama Malicious GGUF Upload"; flow:to_server; content:"POST"; http_method; content:"/api/create"; http_uri; content:"GGUF"; file_data; pcre:"/GGUF.{0,100}\x00{8}/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the model upload functionality if not required, or restrict access to trusted IPs only.
2. Short-term: Apply input validation on GGUF files to check for null pointers before parsing.
3. Long-term: Monitor for an official patch from Ollama and apply it as soon as it becomes available.
4. Workaround: Use a reverse proxy (e.g., Nginx) to filter uploads based on file size or content type, though this is not a complete solution.

Valters IT
Securing Digital Frontiers