Heap Buffer Overflow in stable-diffusion.cpp PyTorch Checkpoint Parsing
Overview
The stable-diffusion.cpp library, used for running various diffusion model inferences, contains a critical heap buffer overflow vulnerability in its PyTorch checkpoint (.ckpt) parser. Specifically, the `SHORT_BINUNICODE` opcode handler within `src/model.cpp` is susceptible to this overflow. The vulnerability arises from a sign confusion issue with the opcode length field. When processing a maliciously crafted `.ckpt` file, an attacker can manipulate this length to a large negative value. This negative value, when interpreted as a size for `memcpy`, results in an excessively large copy operation, leading to heap corruption. Applications that load untrusted `.ckpt` model files using affected versions of stable-diffusion.cpp are at risk. Successful exploitation can cause a denial-of-service by crashing the process, and in certain heap conditions, could potentially be leveraged for arbitrary code execution. The attack vector involves convincing a user or system to load a malicious checkpoint file, often sourced from untrusted model repositories.
Affected Systems
Testing Guide
1. Identify all applications and services that utilize `stable-diffusion.cpp` for loading `.ckpt` model files. 2. Check the specific version of `stable-diffusion.cpp` used by each identified application. This can often be found in dependency management files (e.g., `CMakeLists.txt`, `Makefile`, or package manager configurations) or by checking build artifacts. 3. If the version is prior to `master-584-0a7ae07`, the system is potentially vulnerable. 4. To confirm, attempt to load a known-malicious `.ckpt` file (if available from a security research source) in a controlled, isolated environment and monitor for application crashes or unexpected behavior. However, caution is advised when handling potentially malicious files.
Mitigation Steps
- Update stable-diffusion.cpp to version master-584-0a7ae07 or later. - Avoid loading `.ckpt` model files from untrusted or unverified sources. - Prioritize using safer model formats such as `.safetensors` when available. - Implement input validation on checkpoint file metadata before processing. - Consider sandboxing the model loading process to limit potential impact.
Patch Details
master-584-0a7ae07