Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heap-overflowing Llama.cpp to RCE

retr0.blog

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Heap-overflowing Llama.cpp to RCE

#11

Post by retr0reg »

om8 wrote: post #6

Not surprising, llama.cpp code is a mess. It's sad that hacked things that emerge first are way more popular than properly done projects that come later.

In fact the llama.cpp codebase is well-developed and actively maintained. It has undergone iterative security hardening, intensive low-level security checks have been implemented in both the core inference engine and RPC components.

This standard of security is what made the exploitation such challenging and rewarding.

Re: Heap-overflowing Llama.cpp to RCE

#14

Post by PartiallyTyped »

retr0reg wrote: post #11
om8 wrote: post #6

Not surprising, llama.cpp code is a mess. It's sad that hacked things that emerge first are way more popular than properly done projects that come later.

In fact the llama.cpp codebase is well-developed and actively maintained. It has undergone iterative security hardening, intensive low-level security checks have been implemented in both the core inference engine and RPC components. This standard of security is what made the exploitation such challenging and rewarding.

Thanks for the writeup! Was a very interesting read! I've subscribed and I am looking forward to your next exploits! ^_^

Re: Heap-overflowing Llama.cpp to RCE

#15

Post by worldsavior »

VladVladikoff wrote: post #5

This is really incredible work. And the fact that you are 15 is blowing my mind. You have a really bright future ahead of you, and your parents must be really proud (at least I would be if you were my kid.) Hit me up if you want a summer internship finding security vulnerabilities at a hotel software startup (access control, property management, etc)

[flagged]

Re: Heap-overflowing Llama.cpp to RCE

#18

Post by vlovich123 »

retr0reg wrote: post #11
om8 wrote: post #6

Not surprising, llama.cpp code is a mess. It's sad that hacked things that emerge first are way more popular than properly done projects that come later.

In fact the llama.cpp codebase is well-developed and actively maintained. It has undergone iterative security hardening, intensive low-level security checks have been implemented in both the core inference engine and RPC components. This standard of security is what made the exploitation such challenging and rewarding.

It’s actively maintained but I wouldn’t classify it as a clean codebase. Neither the abstractions it has within ggml, the structure of llama.cpp, effective use of modern c++ etc. it can’t even really make up its mind as to whether it should be c++ or c and there’s a lot of dirt because of that. Heck instead of using a submodule they’re copying ggml between projects making it very difficult to keep track of what’s actually happening where and what the ground truth is. It’s sloppy engineering. Parts are better designed for sure.

None of that is meant to take away from your effort or the success of llama.cpp, but I have spent quite a bit of time reading and working with the internals across layers and have a good eye for quality c++ patterns.

Re: Heap-overflowing Llama.cpp to RCE

#19

Post by ziddoap »

worldsavior wrote: post #15
VladVladikoff wrote: post #5

This is really incredible work. And the fact that you are 15 is blowing my mind. You have a really bright future ahead of you, and your parents must be really proud (at least I would be if you were my kid.) Hit me up if you want a summer internship finding security vulnerabilities at a hotel software startup (access control, property management, etc)

[flagged]

This is a crazy amount of assumptions to make about someone (and their family) that you know nothing about.
Post reply on HN