Information Disclosure in vLLM via PIL Image Address Leak

Executive Summary

vLLM versions 0.14.0rc1 through 0.31.0 have a flaw in the sanitize_message() function. The function uses a regex that only matches lowercase hexadecimal addresses, but PIL image addresses use uppercase. Attackers can send a crafted PNG to endpoints like /tokenize, causing errors that leak live server heap addresses. This helps bypass ASLR protections.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect vLLM versions between 0.14.0rc1 and 0.31.0. Check if the sanitize_message() function uses a case-sensitive regex pattern like r" at 0x[0-9a-f]+" without handling uppercase hex addresses. Review error logs for endpoints like /tokenize that may leak heap addresses in uppercase format (e.g., 0x{id(self):X}).

Commands to check: grep -r "sanitize_message" /path/to/vllm/; grep -r "0x[0-9A-F]" /var/log/vllm/ or application logs. Monitor for PIL-related errors in Hugging Face processor logs.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could exploit this to obtain heap memory addresses from your vLLM server. This information could be used for further attacks like ASLR bypass, potentially leading to remote code execution or other malicious activities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may lead to unauthorized information disclosure, violating data protection principles in GDPR and HIPAA. It could result in non-compliance due to potential exposure of sensitive server memory details, though specific regulatory impacts depend on deployment context.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade vLLM to version 0.31.0 or later. Update the sanitize_message() function regex to include uppercase hex characters (e.g., [0-9a-fA-F]) and add re.IGNORECASE flag. Disable unauthenticated endpoints like /tokenize if not required.

Apply input validation for PNG uploads to prevent crafted files. Review and sanitize all error messages to avoid leaking heap addresses. Monitor logs for suspicious requests targeting multimodal endpoints.

Useful 0 Not Useful 0