CVE-2025-0317

Executive Summary

CVE-2025-0317 is a high-severity Denial of Service (DoS) vulnerability affecting Ollama versions <= 0.3.14. The flaw resides in the ggufPadding function, which is triggered when a malicious user uploads a crafted GGUF model file. By exploiting a division by zero error, an attacker can crash the Ollama server, leading to service unavailability. No authentication is required, and the attack can be executed remotely over the network. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed instances.

Supply Chain & Package Security

Ollama is distributed as a standalone binary and via package managers for Linux, macOS, and Windows. The vulnerability is in the core GGUF model parsing logic, which is part of the Ollama binary itself. Users who download Ollama from the official website or package repositories are affected. There is no known compromise of the supply chain, but the lack of a patch means all current distributions are vulnerable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Server crash leads to total service denial.

Threat Level: High. The ease of exploitation (no auth, low complexity) and the potential for complete service disruption make this a critical concern for any organization running Ollama.

Deep Dive & Mechanics

The vulnerability is in the ggufPadding function within Ollama's GGUF model file parser. GGUF (GPT-Generated Unified Format) is a binary format for storing machine learning models. The function calculates padding to align data structures, but it fails to validate the input before performing a division operation.

When a malicious user uploads a crafted GGUF file, the ggufPadding function receives a value that causes a division by zero. In C/C++ (the likely implementation language), division by zero triggers undefined behavior, typically resulting in a SIGFPE (floating-point exception) and immediate process termination. This crashes the Ollama server, making it unavailable to all users.

The attack vector is the model upload API endpoint. An attacker can send a POST request with a specially crafted GGUF file to the /api/create or similar endpoint. The server parses the file and crashes before any validation can occur.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

int ggufPadding(int value, int alignment) {
    // No check for alignment == 0
    return (value + alignment - 1) / alignment * alignment;
}

Patched Code (Hypothetical):

int ggufPadding(int value, int alignment) {
    if (alignment == 0) {
        // Handle error, return value unchanged or log
        return value;
    }
    return (value + alignment - 1) / alignment * alignment;
}

The fix would involve adding a check for alignment == 0 before performing the division.

Exploitation & Lab Setup

Red Team

Objective: Crash the Ollama server by uploading a malicious GGUF file.

Prerequisites:

• Access to an Ollama server (e.g., http://target:11434)
• Ability to send HTTP POST requests

Steps:

1. Create a minimal GGUF file with a crafted header that triggers the division by zero. The exact structure requires reverse engineering the GGUF format, but the key is to set the alignment field to 0.
2. Send the file to the Ollama API:

   curl -X POST http://target:11434/api/create \
        -H "Content-Type: application/octet-stream" \
        --data-binary @malicious.gguf
   

3. The server will crash immediately. Verify by attempting to access the API:

   curl http://target:11434/api/tags
   

   This should return a connection error.

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team

Detection:

• Monitor for rapid connection drops to the Ollama API.
• Look for repeated uploads of GGUF files with unusual sizes or headers.
• Use network monitoring to detect anomalous POST requests to /api/create.

Mitigation:

• Restrict access to the Ollama API using a firewall or reverse proxy (e.g., Nginx with IP whitelisting).
• Implement rate limiting on the upload endpoint.
• Run Ollama in a container with resource limits and automatic restart policies (e.g., Docker --restart=always).
• Monitor server logs for crashes (e.g., dmesg or systemd journal).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/create with Content-Type: application/octet-stream
  • Unusually small or malformed GGUF files (e.g., file size < 1KB)
• System:
  • Ollama process crash logs (e.g., SIGFPE in dmesg)
  • Core dump files in /var/crash/ or similar
• File:
  • GGUF files with alignment field set to 0 (requires binary analysis)

Detection Engineering

YARA Rule

rule CVE_2025_0317_GGUF_DivisionByZero {
    meta:
        description = "Detects malicious GGUF files exploiting CVE-2025-0317"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-0317"
    strings:
        $gguf_magic = "GGUF" ascii
        $alignment_zero = { 00 00 00 00 } // 4-byte zero alignment field
    condition:
        $gguf_magic at 0 and $alignment_zero at 8
}

Sigma Rule

title: Ollama GGUF Division by Zero DoS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-0317 by uploading a malicious GGUF file
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/create'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate model uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0317 Ollama GGUF DoS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/create"; http.content_type; content:"application/octet-stream"; file.size; < 1024; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Use a firewall to limit access to the Ollama API (port 11434) to trusted IPs only.
2. Implement Rate Limiting: Use a reverse proxy (e.g., Nginx) to limit the number of upload requests per IP.
3. Run with Restart Policy: Use Docker with --restart=always to automatically recover from crashes.
4. Monitor Logs: Set up alerts for Ollama process crashes.

Long-Term Fix:

• Wait for an official patch from Ollama. Monitor the official repository (https://github.com/ollama/ollama) for updates.
• Once patched, upgrade to the latest version immediately.

Workaround:

• Disable the model upload API if not needed, or implement a custom validation layer that checks GGUF file integrity before passing it to the parser.

Valters IT