Breaking Local AI Runtimes - Exploiting llama cpp and Ollama

The talk treats local AI inference runtimes such as llama.cpp and Ollama as ordinary native code, where memory management happens outside the language safety that surrounds it. The presenters split their research across three trust boundaries: the JNI bridge used by Android apps, the HTTP server's model lifecycle, and the Go-to-C interface inside Ollama. They stress that the work is about exploiting the runtime itself, not prompt injection.

On Android, a race between model unload and a benchmark routine leaves a freed context in use. The team reclaims the freed allocation with attacker-chosen contents, redirects a virtual call, and demonstrates code execution inside the host app. In the llama.cpp server, an idle-unload feature can free a model while request handlers still hold a pointer to its vocabulary. They reclaim that chunk remotely across threads and reach an attacker-controlled dereference, but stop short of full remote code execution because they still lack an address leak to defeat ASLR. In Ollama, crafted GGUF tensor shapes make quantization read past a Go-backed buffer. By choosing a conversion path that preserves data, the leaked heap contents survive into the saved model.

The practical takeaways are to avoid idle unloading on exposed servers, place authenticated TLS proxies in front of them, validate every size read from a model file, and use checked arithmetic. Audit unsafe and cgo boundaries for the same patterns. Vendor responses were uneven, and some upstream patches were closed, so the speakers published their fixes.