DEF CON 34 - Main - Breaking Local AI Runtimes Exploiting llama cpp & Ollama - V Tokarev, O Itach
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
Local LLM runtimes now sit inside phones, desktops, and internal servers, but the layer underneath is still ordinary native code. We analyzed llama.cpp and Ollama across three trust boundaries: JNI, HTTP lifecycle code, and Go/C bindings. First, in the llama.cpp Android integration, Java can free a native llama_context while native code is still using it. We reclaim the freed 648-byte object, redirect a vtable call, and show code execution in the embedding app.
Description from DEF CON.
Explained
The technology and terms in this story. Learn more
- TechnologyLLM · Large language modelAn AI model trained on huge amounts of text to understand and generate language, such as ChatGPT or Claude.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- AttackPrompt injectionHiding instructions in content an AI reads, so it follows the attacker instead of its user.
