Summary
ExLlamaV3's EXL3 loader uses an index supplied by a model to select a CUDA kernel without confirming that the index is within the valid kernel table. A malicious model may trigger an out-of-bounds function-pointer read, causing a reproducible crash and, under specific memory-layout conditions, potentially enabling controlled indirect kernel dispatch during model loading.
ExLlamaV3's EXL3 loader uses an index supplied by a model to select a CUDA kernel without confirming that the index is within the valid kernel table. A malicious model may trigger an out-of-bounds function-pointer read, causing a reproducible crash and, under specific memory-layout conditions, potentially enabling controlled indirect kernel dispatch during model loading.
Affected context
The issue occurs in ExLlamaV3 deployments that load EXL3 models through the CUDA-backed EXL3 loader. It becomes risky when model metadata or model-controlled indexes are treated as trusted selectors for kernel dispatch without range validation. Exploitability may depend on the host process's memory layout and the privileges available to the model-loading runtime.
The issue occurs in ExLlamaV3 deployments that load EXL3 models through the CUDA-backed EXL3 loader. It becomes risky when model metadata or model-controlled indexes are treated as trusted selectors for kernel dispatch without range validation. Exploitability may depend on the host process's memory layout and the privileges available to the model-loading runtime.
Exploit preconditions
- Attack surface: EXL3 model loading and CUDA kernel selection
- Required access: Ability to provide or cause the runtime to load a malicious EXL3 model
- Trigger point: Processing the model-supplied kernel index during loader initialization
- Why exploitation is possible: The index is used to access a function-pointer table before bounds validation, allowing an invalid memory reference and potentially controlled indirect dispatch under favorable memory conditions
- Attack surface: EXL3 model loading and CUDA kernel selection
- Required access: Ability to provide or cause the runtime to load a malicious EXL3 model
- Trigger point: Processing the model-supplied kernel index during loader initialization
- Why exploitation is possible: The index is used to access a function-pointer table before bounds validation, allowing an invalid memory reference and potentially controlled indirect dispatch under favorable memory conditions
Why this happens
The underlying bug is an unchecked array or table index derived from untrusted model data. The loader assumes that the supplied value identifies a valid CUDA kernel, but does not establish that it falls within the dispatch table's permitted range before dereferencing the corresponding function pointer. This behavior maps primarily to CWE-125: Out-of-Bounds Read, with related weaknesses involving improper input validation (CWE-20) and unsafe out-of-range memory access (CWE-787).
The underlying bug is an unchecked array or table index derived from untrusted model data. The loader assumes that the supplied value identifies a valid CUDA kernel, but does not establish that it falls within the dispatch table's permitted range before dereferencing the corresponding function pointer. This behavior maps primarily to CWE-125: Out-of-Bounds Read, with related weaknesses involving improper input validation (CWE-20) and unsafe out-of-range memory access (CWE-787).
Potential impact
- The model-loading process may crash reliably, causing denial of service.
- A malicious model could potentially redirect indirect kernel dispatch under specific host memory conditions.
- The application or worker process may be compromised if controlled dispatch becomes achievable.
- GPU workloads, service availability, or data processed by the runtime could be disrupted.
- The model-loading process may crash reliably, causing denial of service.
- A malicious model could potentially redirect indirect kernel dispatch under specific host memory conditions.
- The application or worker process may be compromised if controlled dispatch becomes achievable.
- GPU workloads, service availability, or data processed by the runtime could be disrupted.
General mitigation guidance
Mitigation generally centers on treating all model-supplied indexes and metadata as untrusted input.
Defensive patterns include:
- Validate indexes against the exact dispatch-table bounds before any access or function-pointer use.
- Reject malformed or inconsistent model metadata before initializing GPU execution paths.
- Prefer bounded, typed dispatch mechanisms over direct function-pointer selection where practical.
- Run model loading with least-privilege host and GPU permissions.
- Isolate untrusted model workloads and limit access to sensitive host resources.
- Apply fail-closed handling for invalid indexes rather than attempting fallback memory access.
Mitigation generally centers on treating all model-supplied indexes and metadata as untrusted input.
Defensive patterns include:
- Validate indexes against the exact dispatch-table bounds before any access or function-pointer use.
- Reject malformed or inconsistent model metadata before initializing GPU execution paths.
- Prefer bounded, typed dispatch mechanisms over direct function-pointer selection where practical.
- Run model loading with least-privilege host and GPU permissions.
- Isolate untrusted model workloads and limit access to sensitive host resources.
- Apply fail-closed handling for invalid indexes rather than attempting fallback memory access.
How teams detect issues like this
Detection can include:
- Static analysis for array, vector, or function-pointer accesses controlled by parsed model fields without preceding range checks.
- Code review of model loaders for trust-boundary crossings between serialized metadata and native dispatch logic.
- Fuzz testing with negative, oversized, truncated, and boundary-value kernel indexes.
- Runtime instrumentation that detects invalid table indexes, unexpected indirect calls, and loader crashes.
- Policy enforcement requiring schema validation and bounded dispatch checks for untrusted model formats.
- Automated security review tools may help identify unchecked indexing and native memory-safety patterns.
Detection can include:
- Static analysis for array, vector, or function-pointer accesses controlled by parsed model fields without preceding range checks.
- Code review of model loaders for trust-boundary crossings between serialized metadata and native dispatch logic.
- Fuzz testing with negative, oversized, truncated, and boundary-value kernel indexes.
- Runtime instrumentation that detects invalid table indexes, unexpected indirect calls, and loader crashes.
- Policy enforcement requiring schema validation and bounded dispatch checks for untrusted model formats.
- Automated security review tools may help identify unchecked indexing and native memory-safety patterns.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| kb. | kb.cert.org/ |
| kb. | kb.cert.org/ |
