Executive Summary

This vulnerability exists in vLLM, an inference and serving engine for large language models (LLMs), in versions prior to 0.23.1rc0. The issue arises because the temperature validation gates use comparison operators (<, >) that silently evaluate to False for special floating-point values like NaN (Not a Number) and positive Infinity according to Python's IEEE 754 float semantics.

As a result, these special values bypass the validation checks and propagate to GPU sampling kernels. This leads to undefined behavior or CUDA errors that can crash the inference worker.

The vulnerability is fixed in version 0.23.1rc0.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that it can cause the inference worker in vLLM to crash due to undefined behavior or CUDA errors when processing NaN or positive Infinity temperature values.

This can lead to denial of service conditions where the large language model inference engine becomes unavailable or unstable.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade vLLM to version 0.23.1rc0 or later, where the temperature validation gates have been fixed to properly handle NaN and positive Infinity values, preventing undefined behavior and CUDA errors.

Useful 0 Not Useful 0