Lethal Language Models: From Bit Flip To RCE In Ollama

Paul Gerste, a vulnerability researcher at Sonar, examines Ollama, a tool for downloading and running large language models locally, as a target in the AI category of Pwn2Own Berlin 2025. He explains the client-server design, where the server starts a separate runner process that loads models stored in the GGUF format, and walks through the file's layout of metadata, tensor descriptions and raw weight data.

Three parser bugs were covered. An unchecked string copy overflows a small fixed buffer. A helper that reads arrays of strings never verifies element types, which yields a pointer read that is only useful with an information leak. The most useful bug was a heap out-of-bounds write through a bit-packed boolean vector, which can only flip zero bits to one. Targeting null function pointers in a backend struct gave a way to redirect control flow. Because the runner's memory layout is randomized for each process and no leak was available, the speaker built a test variant with PIE disabled. He then assembled a ROP chain that pivoted the stack and rewrote a libc free entry in the global offset table to point at system, triggered by a follow-up prompt. A live demo and a public CTF challenge based on the bug followed.

The exploit only worked without PIE, so it would not have been a viable contest entry. Shortly before the event, Ollama replaced the vulnerable C++ engine with a Go rewrite, removing the bug. The takeaway is that performance-driven C and C++ code in AI tooling carries memory-safety risk, and that fast development cycles can ship such issues. The speaker also recommends Pwn2Own as a learning exercise, even without a winning entry.