llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCE

Impact

The llama.cpp RPC server is what operators use to fan a model across several GPU hosts, and its backend port speaks an unauthenticated binary protocol. An attacker who can open that port stores a computation graph, frees the buffers it references, then reclaims the freed memory with content of their choosing so the stored graph is re-executed through dangling pointers. That yields arbitrary read and write inside the server process, which the advisory describes as full remote code execution. On a GPU node the process holds the device context and the model weights, so this is code execution beside other tenants' work with no credential ever presented.

Who can reach it

Anyone with network reach to the llama.cpp RPC backend port. No authentication and no user interaction; the protocol has no auth layer to begin with, so any tenant network or management VLAN that can route to the port is enough.

What to do

Upgrade to release b8585 or later and restart every rpc-server process; the fix is a single commit in the RPC graph handling. Cost is a serving restart and model reload per node, not a reboot. If you cannot upgrade now, bind the RPC port to a private link between the shards and firewall it off from tenant networks - the protocol was never meant to face untrusted callers.

References