Remote Code Execution in vLLM via Pickle Deserialization

Executive Summary

This vulnerability affects vLLM versions before 0.32.0. An authenticated attacker can forge shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust these values and pass attacker-selected bytes to pickle.loads(), enabling arbitrary Python code execution even when insecure serialization is disabled.

Useful 0 Not Useful 0

Impact Analysis

An attacker could execute arbitrary code on affected systems, potentially leading to data theft, system compromise, or disruption of services. This is especially critical in shared or multi-tenant environments where authentication is required but isolation is not strictly enforced.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.32.0 or later to address the vulnerability. Ensure shared-memory multimodal caching is disabled if not required.

Useful 0 Not Useful 0