T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/benchmark_models.sh:39- Finding
Untrusted llama-bench Auto-Discovery Can Execute an Attacker-Controlled Binary
- Content
View full analysis
/dev/null | grep -E "llama-bench$" | head -1) if [ -n "$found" ] && [ -x "$found" ]; then echo "$found" return 0 fi return 1 ``` The discovered executable is subsequently invoked: ```bash if $LLAMA_BENCH -m "$model" -p "$PROMPT_SIZES" -n "$GEN_SIZES" -ngl "$GPU_LAYERS" 2>&1 >> "$RESULTS_FILE"; then echo -e "${GREEN}✓ Completed: $model_name${NC}" else echo -e "${RED}✗ Failed: $model_name${NC}" echo "ERROR: Benchmark failed" >> "$RESULTS_FILE" fi ``` ### Technical Analysis When none of the preferred `llama-bench` paths exists, `find_llama_bench` recursively searches the user's home directory and `/DATA`. It selects the first path whose basename is `llama-bench` and checks only whether that file is executable. The script does not verify: - The discovered file's owner or permissions. - Whether its parent directory is writable by untrusted users. - Its canonical path. - Its checksum, signature, or provenance. - Whether it originates from an approved llama.cpp installation. Consequently, an executable merely named `llama-bench` can be treated as a trusted tool. The `$LLAMA_BENCH` command variable is also invoked without double quotes, which can produce incorrect command parsing when the selected path contains whitespace, although the primary risk is trusting an unverified executable. ### Attack Path 1. The expected binaries at the script's preferred locations are absent. 2. An attacker who can write into a searched location under the victim's home directory or `/DATA` creates an executable named `llama-bench`. 3. The attacker arranges for that file to be the first matching result returned by `find`. 4. The victim invokes `scripts/benchmark_models.sh` with a GGU ...[truncated 856 chars]- Remediation
View remediation
> "$RESULTS_FILE" 2>&1; then echo -e "${GREEN}✓ Completed: $model_name${NC}" else echo -e "${RED}✗ Failed: $model_name${NC}" echo "ERROR: Benchmark failed" >> "$RESULTS_FILE" fi ``` 7. If automatic lookup remains necessary, use a trusted `PATH`, resolve the result with `command -v`, and then apply ownership, permission, and path validation before execution. ]]>