推論系統安全
llama.cpp b11000 Clears Stale Computation Graphs, Patching an Unauthenticated RPC Remote Code Execution Vulnerability
The llama.cpp RPC server could replay cached computation graphs that still pointed to freed buffers, allowing remote clients to gain read/write capabilities and execute code. b11000 discards the associated graph state when a buffer is freed, but RPC still should not be exposed directly to untrusted networks.
llama.cpp released the b11000 prerelease on September 16, fixing a use-after-free vulnerability in `ggml-rpc-server`. The RPC backend retains the most recent computation graph for each device, allowing clients to replay it with `GRAPH_RECOMPUTE` without retransmitting tensor data. The problem was that graph nodes stored direct pointers to backend buffers. After a client called `FREE_BUFFER`, the cached graph was not invalidated, so replaying it again caused access to freed memory through dangling pointers.
The project’s release notes state that an attacker could trigger this path without authentication and reshape the freed memory region through subsequent `ALLOC_BUFFER` and `SET_TENSOR` calls. The read/write capabilities provided by the computation graph could leak libc addresses, enabling an attacker to hijack the buffer interface vtable used by `BUFFER_CLEAR` and ultimately execute arbitrary code with the privileges of the RPC server process. This was not merely a denial-of-service issue that could crash inference; it posed a host-takeover risk for distributed inference nodes.
The b11000 fix is relatively straightforward: `free_buffer()` now clears the cached computation graph, causing the existing null check in subsequent `graph_recompute()` calls to reject the request, after which the client falls back to a full `GRAPH_COMPUTE`. The patch does not change the protocol or API, so upgrading generally requires no client-side modifications. Operators should use b11000 or later and check whether container images, static binaries, or downstream applications still bundle older commits.
Defenses should not stop at upgrading. llama.cpp’s security policy explicitly recommends against using the RPC backend or `ggml-rpc-server` on untrusted networks. In production deployments, access should still be restricted through firewalls, private network segments, process privilege reduction, and container isolation. This release is a prerelease, and the official page does not provide a CVSS score, the earliest affected version, or complete independent validation details. It remains to be seen whether a formal security advisory will follow and how quickly derivative packages will incorporate the fix.