Race Condition in vLLM Common Prefix Handler

Executive Summary

This vulnerability is a race condition in the vllm-project vllm 0.30.0/0.31.0 component called Common Prefix Handler, specifically in the file single_type_kv_cache_manager.py. It allows an attacker to remotely exploit a timing-sensitive issue where requests may be incorrectly decoded using another request's Key-Value (KV) prefix under specific conditions involving Cascade attention and SimpleCPUOffloadConnector.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to vLLM's cascade attention feature and SimpleCPUOffloadConnector. Detection requires checking vLLM version and configuration. Use commands like 'pip show vllm' to verify version. If using v0.30.0 or 0.31.0, the system is vulnerable. Check logs for batch processing with shared prefixes and CPU offloading enabled.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could lead to incorrect decoding of requests, causing output errors or data leaks. It may affect batch processing where requests share prefixes, potentially resulting in wrong responses or unauthorized access to sensitive data. Exploitation is complex but possible from remote.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or incorrect processing of sensitive information, violating GDPR's data integrity and confidentiality principles or HIPAA's security requirements for protected health information. Compliance may be compromised if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.32.0 or later immediately. The patch e687a251bb056fa527846633f7a1b0a6c0f42374 resolves the issue. Disable cascade attention if not already disabled by default. Review batch processing configurations to avoid shared prefixes with CPU offloading.

Useful 0 Not Useful 0