# Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations

Ollama's /api/pull trusts the digest field in a malicious registry manifest, enabling path traversal file write and RCE via ld.so.preload.

- Payout: Research
- Severity: critical
- Program: Ollama
- Credited: Wiz Research
- Disclosed: 2024-06-24
- CVE: CVE-2024-37032
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-probllama-ollama-vulnerability-cve-2024-37032
- Tags: domain:ai impact:data-leak impact:rce kind:research platform:threat-intel sev:critical tech:docker technique:chained vuln:file-upload vuln:path-traversal vuln:rce

**Target:** Ollama HTTP API server (/api/pull, /api/push, /api/chat)
**Root cause:** The digest field of a manifest layer is used to construct the on-disk blob path without validation, allowing traversal sequences to escape the blobs directory and write arbitrary files.
**Steps:**
1. Set up a malicious private registry serving a manifest whose config/layers digest is `../../../../.../traversal`.
2. POST to `http://[victim]:11434/api/pull` referencing the malicious registry to write arbitrary files.
3. Plant a malicious manifest at `/root/.ollama/models/manifests/%ATTACKER_IP%/library/manifest/latest` to register a new model.
4. Use `/api/push` with a traversal digest to leak arbitrary file contents (arbitrary file read).
5. Write payload shared library to `/root/bad.so` and overwrite `/etc/ld.so.preload` to reference it.
6. Query `/api/chat` to spawn a new process that loads the malicious library, achieving RCE.
**How found:** Team wanted a large-context model and self-hosted via Ollama; they questioned whether private registries are blindly trusted and inspected how the digest field is used to store blobs on disk, spotting missing validation.
**Exploitation:** Attacker hosts a malicious registry, triggers /api/pull to write files via traversal digest, plants a manifest, overwrites /etc/ld.so.preload with a path to an attacker-uploaded .so, then hits /api/chat so a new process loads the library as root in Docker deployments.
**Escalation:** Chained arbitrary file write into arbitrary file read (via /api/push) and then into RCE by hijacking ld.so.preload; Docker deployments run as root on 0.0.0.0.
**Insight:** Model/artifact registries that mirror Docker's manifest format often reuse the digest as a filesystem path; test whether digest strings are validated before being joined into blob paths, and use push/pull symmetry to convert a write primitive into a read primitive.