From 678f1a29103760f51f3f77b616142a9ceaa5c46f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 21 Mar 2025 21:52:40 +0000 Subject: [PATCH] Publish Advisories GHSA-9mc5-7qhg-fp3w GHSA-x3m8-f7g5-qhm7 --- .../2025/03/GHSA-9mc5-7qhg-fp3w/GHSA-9mc5-7qhg-fp3w.json | 6 +++++- .../2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/advisories/github-reviewed/2025/03/GHSA-9mc5-7qhg-fp3w/GHSA-9mc5-7qhg-fp3w.json b/advisories/github-reviewed/2025/03/GHSA-9mc5-7qhg-fp3w/GHSA-9mc5-7qhg-fp3w.json index d20c8cb6ea1..21ba2ab7494 100644 --- a/advisories/github-reviewed/2025/03/GHSA-9mc5-7qhg-fp3w/GHSA-9mc5-7qhg-fp3w.json +++ b/advisories/github-reviewed/2025/03/GHSA-9mc5-7qhg-fp3w/GHSA-9mc5-7qhg-fp3w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9mc5-7qhg-fp3w", - "modified": "2025-03-12T21:55:48Z", + "modified": "2025-03-21T21:51:07Z", "published": "2025-03-11T21:12:54Z", "aliases": [ "CVE-2025-27591" @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/facebookincubator/below/commit/10e73a21d67baa2cd613ee92ce999cda145e1a83" }, + { + "type": "WEB", + "url": "https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3" + }, { "type": "PACKAGE", "url": "https://github.com/facebookincubator/below" diff --git a/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json b/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json index 756c03e7e13..32d5c7b3205 100644 --- a/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json +++ b/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-x3m8-f7g5-qhm7", - "modified": "2025-03-20T18:58:15Z", + "modified": "2025-03-21T21:50:09Z", "published": "2025-03-19T15:55:58Z", "aliases": [ "CVE-2025-29783" ], "summary": "vLLM Allows Remote Code Execution via Mooncake Integration", - "details": "### Summary\nWhen vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts.\n\n### Details\n1. Pickle deserialization vulnerabilities are [well documented](https://docs.python.org/3/library/pickle.html).\n2. The [mooncake pipe](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L206) is exposed over the network (by design to enable disaggregated prefilling across distributed environments) using ZMQ over TCP, greatly increasing exploitability. Further, the mooncake integration opens these sockets listening on all interfaces on the host, meaning it can not be configured to only use a private, trusted network.\n4. The root problem is [`recv_tensor()`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L257) calls [`_recv_impl`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L244) which passes the raw network bytes to `pickle.loads()`. Additionally, it does not appear that there are any controls (network, authentication, etc) to prevent arbitrary users from sending this payload to the affected service.\n\n### Impact\nThis is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts.\n\n### Remediation\nThis issue is resolved by https://github.com/vllm-project/vllm/pull/14228", + "details": "### Summary\nWhen vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts.\n\n### Details\n1. Pickle deserialization vulnerabilities are [well documented](https://docs.python.org/3/library/pickle.html).\n2. The [mooncake pipe](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L206) is exposed over the network (by design to enable disaggregated prefilling across distributed environments) using ZMQ over TCP, greatly increasing exploitability. ~~Further, the mooncake integration opens these sockets listening on all interfaces on the host, meaning it can not be configured to only use a private, trusted network.~~\n\nOnly `sender_socket` and `receiver_ack` are allowed to be accessed publicly, while the data actually decompressed by `pickle.loads()` comes from [recv_bytes](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L257). Its interface is defined as `self.receiver_socket.connect(f\\\"tcp://{d_host}:{d_rank_offset + 1}\\\")`, where `d_host` is `decode_host`, a locally defined address 192.168.0.139,from mooncake.json (https://github.com/kvcache-ai/Mooncake/blob/main/doc/en/vllm-integration-v0.2.md?plain=1#L36).\n\n3. The root problem is [`recv_tensor()`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L257) calls [`_recv_impl`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L244) which passes the raw network bytes to `pickle.loads()`. Additionally, it does not appear that there are any controls (network, authentication, etc) to prevent arbitrary users from sending this payload to the affected service.\n\n\n\n### Impact\nThis is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts.\n\n### Remediation\nThis issue is resolved by https://github.com/vllm-project/vllm/pull/14228", "severity": [ { "type": "CVSS_V3",