Executive Summary

The vulnerability affects vLLM, an inference and serving engine for large language models, specifically versions prior to 0.22.1. The issue arises from a dependency confusion attack involving the flashinfer-jit-cache package. This package is installed from a custom index but was not registered on the official PyPI repository. Because the global setting UV_INDEX_STRATEGY="unsafe-best-match" is enabled, an attacker can register a malicious version of flashinfer-jit-cache on PyPI. During the Docker build process, this malicious package can execute arbitrary code as root, compromising the container images.

This attack allows the attacker to backdoor every resulting container image, potentially leading to exfiltration of sensitive data such as user prompts, API credentials, and model data from production vLLM deployments. The vulnerability was fixed in version 0.22.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized execution of code with root privileges during the Docker build process. An attacker can implant backdoors in container images, which compromises the security and integrity of your deployments.

• Exfiltration of all user prompts
• Theft of API credentials
• Exposure of model data from production vLLM deployments

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade vLLM to version 0.22.1 or later, where the issue has been fixed.

Avoid using the vulnerable Dockerfile versions prior to 0.22.1 that install the flashinfer-jit-cache package from an untrusted custom index with unsafe index strategy settings.

Ensure that package installations do not rely on unregistered or unverified packages from custom indexes to prevent dependency confusion attacks.

Useful 0 Not Useful 0