From dbf08f2803776f17fa304edb41b62f5a2337bf27 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 29 Apr 2025 16:44:46 +0000
Subject: [PATCH] Publish GHSA-vc6m-hm49-g9qg

---
 .../GHSA-vc6m-hm49-g9qg.json                  | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/04/GHSA-vc6m-hm49-g9qg/GHSA-vc6m-hm49-g9qg.json

diff --git a/advisories/github-reviewed/2025/04/GHSA-vc6m-hm49-g9qg/GHSA-vc6m-hm49-g9qg.json b/advisories/github-reviewed/2025/04/GHSA-vc6m-hm49-g9qg/GHSA-vc6m-hm49-g9qg.json
new file mode 100644
index 00000000000..d3ed26bf028
--- /dev/null
+++ b/advisories/github-reviewed/2025/04/GHSA-vc6m-hm49-g9qg/GHSA-vc6m-hm49-g9qg.json
@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vc6m-hm49-g9qg",
+  "modified": "2025-04-29T16:43:10Z",
+  "published": "2025-04-29T16:43:10Z",
+  "aliases": [],
+  "summary": "phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service",
+  "details": "### Summary\nA critical performance vulnerability has been identified in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_*|>, <|image_*|>) with repeated tokens based on precomputed lengths. Due to ​​inefficient list concatenation operations​​, the algorithm exhibits ​​quadratic time complexity (O(n²))​​, allowing malicious actors to trigger resource exhaustion via specially crafted inputs.\n\n### Details\n​​Affected Component​​: input_processor_for_phi4mm function.\nhttps://github.com/vllm-project/vllm/blob/8cac35ba435906fb7eb07e44fe1a8c26e8744f4e/vllm/model_executor/models/phi4mm.py#L1182-L1197\n\nThe code modifies the input_ids list in-place using input_ids = input_ids[:i] + tokens + input_ids[i+1:]. Each concatenation operation copies the entire list, leading to O(n) operations per replacement. For k placeholders expanding to m tokens, total time becomes O(kmn), approximating O(n²) in worst-case scenarios.\n\n### PoC\nTest data demonstrates exponential time growth:\n```python\ntest_cases = [100, 200, 400, 800, 1600, 3200, 6400]\nrun_times = [0.002, 0.007, 0.028, 0.136, 0.616, 2.707, 11.854]  # seconds\n```\nDoubling input size increases runtime by ~4x (consistent with O(n²)).\n\n### Impact\n​​Denial-of-Service (DoS):​​ An attacker could submit inputs with many placeholders (e.g., 10,000 <|audio_1|> tokens), causing CPU/memory exhaustion.\nExample: 10,000 placeholders → ~100 million operations.\n\n\n### Remediation Recommendations​\nPrecompute all placeholder positions and expansion lengths upfront.\nReplace dynamic list concatenation with a single preallocated array.\n```python\n# Pseudocode for O(n) solution\nnew_input_ids = []\nfor token in input_ids:\n    if token is placeholder:\n        new_input_ids.extend([token] * precomputed_length)\n    else:\n        new_input_ids.append(token)\n```",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "vllm"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.8.0"
+            },
+            {
+              "fixed": "0.8.5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-vc6m-hm49-g9qg"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/vllm-project/vllm"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/vllm-project/vllm/blob/8cac35ba435906fb7eb07e44fe1a8c26e8744f4e/vllm/model_executor/models/phi4mm.py#L1182-L1197"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1333"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-29T16:43:10Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file