Summary
vLLM before 0.32.0 may unsafely deserialize attacker-controlled data from public multimodal feature parameters in certain scale-out deployments. An authenticated caller who can submit forged shared-memory references may cause workers to pass attacker-selected bytes to pickle.loads(), potentially enabling arbitrary Python code execution.
vLLM before 0.32.0 may unsafely deserialize attacker-controlled data from public multimodal feature parameters in certain scale-out deployments. An authenticated caller who can submit forged shared-memory references may cause workers to pass attacker-selected bytes to pickle.loads(), potentially enabling arbitrary Python code execution.
Affected context
The issue arises in vLLM deployments that use multimodal caching through shared memory and distribute inference work across multiple workers. It requires a code path where workers trust shared-memory address and monotonic identifier values supplied through public multimodal feature data, allowing those values to influence the bytes later passed to a pickle deserializer.
The issue arises in vLLM deployments that use multimodal caching through shared memory and distribute inference work across multiple workers. It requires a code path where workers trust shared-memory address and monotonic identifier values supplied through public multimodal feature data, allowing those values to influence the bytes later passed to a pickle deserializer.
Exploit preconditions
- Attack surface: Public multimodal inference request handling and shared-memory cache coordination
- Required access: An authenticated ability to submit multimodal feature data to the vLLM service
- Deployment condition: Scale-out operation with shared-memory multimodal caching enabled
- Trigger point: Worker processing of attacker-influenced shared-memory references
- Why exploitation is possible: Workers trust forged address and monotonic identifier values and eventually deserialize attacker-selected bytes with
pickle.loads()
- Attack surface: Public multimodal inference request handling and shared-memory cache coordination
- Required access: An authenticated ability to submit multimodal feature data to the vLLM service
- Deployment condition: Scale-out operation with shared-memory multimodal caching enabled
- Trigger point: Worker processing of attacker-influenced shared-memory references
- Why exploitation is possible: Workers trust forged address and monotonic identifier values and eventually deserialize attacker-selected bytes with
pickle.loads()
Why this happens
The underlying bug is a trust-boundary failure involving serialized objects and shared-memory metadata. Worker processes treat caller-influenced address and identifier fields as valid cache references without sufficiently binding them to trusted server-generated state, allowing arbitrary bytes to reach Python pickle deserialization. Because pickle can reconstruct objects with execution-capable behavior, this maps to CWE-502: Deserialization of Untrusted Data, even when broader insecure serialization settings are disabled.
The underlying bug is a trust-boundary failure involving serialized objects and shared-memory metadata. Worker processes treat caller-influenced address and identifier fields as valid cache references without sufficiently binding them to trusted server-generated state, allowing arbitrary bytes to reach Python pickle deserialization. Because pickle can reconstruct objects with execution-capable behavior, this maps to CWE-502: Deserialization of Untrusted Data, even when broader insecure serialization settings are disabled.
Potential impact
- An attacker could execute arbitrary Python code in an affected worker process
- The inference service could be compromised or disrupted
- Model inputs, outputs, or cached multimodal data could be altered
- Service credentials or data accessible to the worker could be exposed
- Compromised workers could facilitate lateral movement within the serving environment
- An attacker could execute arbitrary Python code in an affected worker process
- The inference service could be compromised or disrupted
- Model inputs, outputs, or cached multimodal data could be altered
- Service credentials or data accessible to the worker could be exposed
- Compromised workers could facilitate lateral movement within the serving environment
General mitigation guidance
Mitigation generally focuses on removing untrusted data from pickle deserialization paths and strengthening cache-reference integrity.
Common defensive patterns include:
- Replacing pickle-based processing with a safe, constrained serialization format for untrusted or semi-trusted data
- Treating shared-memory addresses and cache identifiers as server-generated capabilities rather than caller-provided references
- Validating ownership, lifetime, type, bounds, and cryptographic integrity of cache metadata before dereferencing it
- Disabling shared-memory multimodal caching where it is not required
- Separating inference workers with least-privilege identities, restricted filesystem access, and limited network permissions
- Keeping authentication, authorization, and request-level resource controls enforced at the inference boundary
- Ensuring deserialization occurs only after strict schema and trust validation
Mitigation generally focuses on removing untrusted data from pickle deserialization paths and strengthening cache-reference integrity.
Common defensive patterns include:
- Replacing pickle-based processing with a safe, constrained serialization format for untrusted or semi-trusted data
- Treating shared-memory addresses and cache identifiers as server-generated capabilities rather than caller-provided references
- Validating ownership, lifetime, type, bounds, and cryptographic integrity of cache metadata before dereferencing it
- Disabling shared-memory multimodal caching where it is not required
- Separating inference workers with least-privilege identities, restricted filesystem access, and limited network permissions
- Keeping authentication, authorization, and request-level resource controls enforced at the inference boundary
- Ensuring deserialization occurs only after strict schema and trust validation
How teams detect issues like this
Detection can combine application review, runtime monitoring, and policy enforcement:
- Use static analysis to identify
pickle.loads()and related deserialization calls reachable from request or cache metadata - Review code paths where client-controlled fields select memory locations, object identifiers, or serialized payloads
- Flag trust-boundary crossings between API inputs, shared-memory services, and worker deserializers
- Monitor for anomalous cache identifiers, invalid address ranges, repeated failed lookups, and unexpected worker process behavior
- Enforce repository and CI policies that prohibit unsafe deserialization of request-derived data
- Use automated code review tools to identify dangerous deserialization APIs and missing integrity checks
Detection can combine application review, runtime monitoring, and policy enforcement:
- Use static analysis to identify
pickle.loads()and related deserialization calls reachable from request or cache metadata - Review code paths where client-controlled fields select memory locations, object identifiers, or serialized payloads
- Flag trust-boundary crossings between API inputs, shared-memory services, and worker deserializers
- Monitor for anomalous cache identifiers, invalid address ranges, repeated failed lookups, and unexpected worker process behavior
- Enforce repository and CI policies that prohibit unsafe deserialization of request-derived data
- Use automated code review tools to identify dangerous deserialization APIs and missing integrity checks
