mistral.rs: out-of-bounds read parsing GGUF token id metadata crashes the inference server

Impact

Token id fields in a GGUF file (eos_token_id, bos_token_id, unknown_token_id) are used without bounds checking when converting the GGUF tokenizer to the HF format, giving an out-of-bounds read. Anyone who can get the server to load a crafted GGUF model takes down the serving process; on a GPU node that means the model has to be reloaded and warmed again, and the GPU sits idle through it. The record claims availability impact only - no confidentiality or integrity - and exploit details are public. Operators who let users supply their own model weights carry the real exposure here.

Who can reach it

Anyone who can place a GGUF file the server will load - a self-serve model upload path, a shared model cache, or a hub pull of an untrusted repo. No authentication is implied by the record, but the CVSS vector marks user interaction as required, i.e. someone must load the model.

What to do

Upgrade to mistral.rs 0.8.23 (patch cd5297e) and restart the inference process; each model must be reloaded onto the GPU afterwards. Until patched, only load GGUF files from sources you control and keep tenant-supplied weights out of shared serving instances.

References