In recent developments within the cybersecurity landscape, researchers have brought to light six critical security vulnerabilities within the Ollama artificial intelligence (AI) framework. These flaws present potential risks that, if exploited by malicious actors, can lead to a variety of nefarious activities, including denial-of-service (DoS) attacks, model poisoning, and model theft. The findings were reported by Avi Lumelsky, a researcher from Oligo Security.
Ollama is an open-source platform designed to facilitate the deployment and operation of large language models (LLMs) on local devices, supporting operating systems such as Windows, Linux, and macOS. The project has a significant presence on GitHub, with its repository having been forked 7,600 times to date.
The identified vulnerabilities have been categorised as follows:
CVE-2024-39719 (CVSS score: 7.5) - This vulnerability is linked to the /api/create endpoint. An attacker can exploit it to ascertain the existence of files on the server. The issue has been addressed in Ollama version 0.1.47.
CVE-2024-39720 (CVSS score: 8.2) - An out-of-bounds read vulnerability that can lead to application crashes through the /api/create endpoint, inducing a DoS condition. This vulnerability has been patched in version 0.1.46.
CVE-2024-39721 (CVSS score: 7.5) - This flaw causes resource exhaustion, potentially resulting in a DoS scenario when the /api/create endpoint is repeatedly invoked with the file "/dev/random" as input. The issue was resolved in version 0.1.34.
CVE-2024-39722 (CVSS score: 7.5) - A path traversal vulnerability in the /api/push endpoint that risks exposure of the server’s files and directory structure. It has been fixed in version 0.1.46.
Additionally, two other vulnerabilities remain unpatched. One involves model poisoning via the /api/pull endpoint from an untrusted source, and the other entails model theft through the /api/push endpoint to an untrusted target. To mitigate these, it is advised that endpoints exposed to the internet be filtered using a proxy or web application firewall.
Increased scrutiny has also been highlighted because the platform's default settings expose all endpoints, posing risks to those not filtering HTTP routing to Ollama adequately.
Research indicates that Ollama's framework is widely used across the globe, with 9,831 distinct internet-facing instances detected. These instances predominantly exist in countries including China, the United States, Germany, South Korea, Taiwan, France, the United Kingdom, India, Singapore, and Hong Kong. Alarmingly, one in four of these servers is susceptible to the newfound vulnerabilities.
This discovery comes on the heels of a prior significant vulnerability (CVE-2024-37032) revealed by cloud security firm Wiz, which highlighted a remote code execution risk within Ollama.
Avi Lumelsky emphasised the severe risks posed by exposing Ollama to the internet without proper authorisation, comparing it to exposing the Docker socket publicly, given its capability to upload files and manage model pulling and pushing, which could be manipulated by attackers.
As the situation unfolds, it is crucial for users and developers employing the Ollama AI framework to implement suggested protective measures and keep abreast of updates and patches provided by the maintainers to safeguard against potential exploits.
Source: Noah Wire Services