Out-of-Bounds Read in Mooncake Transfer Engine

Executive Summary

This vulnerability is an out-of-bounds read flaw in Mooncake's transfer engine before version 0.3.12. It exists in the readString function of include/common.h. Attackers can exploit it by sending a zero-length handshake frame to the service's handshake port, causing a crash. The issue allows unauthenticated remote attackers to terminate hosting processes like SGLang inference servers by sending an eight-byte frame.

Useful 0 Not Useful 0

Detection Guidance

Check if Mooncake transfer engine version is below 0.3.12 by running: mooncake-transfer-engine --version. Monitor for crashes in SGLang or vLLM processes after network connections to ports 15000-17000. Use tcpdump or Wireshark to inspect for zero-length handshake frames sent to these ports.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) conditions. Unauthenticated attackers can remotely crash critical services such as SGLang or vLLM inference servers by sending malformed handshake frames. This forces service restarts, disrupting availability and potentially causing downtime in production environments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts service availability by crashing the Mooncake transfer engine, which could disrupt systems handling sensitive data. For GDPR, it may affect data processing continuity and availability requirements. For HIPAA, it could compromise service uptime for systems managing protected health information. However, the CVE does not explicitly detail compliance impacts beyond service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mooncake transfer engine to version 0.3.12 or later immediately. Block external access to ports 15000-17000 using firewalls until patched. Restart affected services like SGLang or vLLM after upgrading to ensure the fix is applied.

Useful 0 Not Useful 0