| शीर्षक | Vllm aibrix 0.2.0 prefix cache reuse |
|---|
| विवरण | Summary
Maliciously crafted prompts may cause hash collisions, leading to prefix cache reuse, which could interfere with subsequent responses and result in unintended behavior.
Details
aibrix's prefix caching mechanism relies on the xxhash64 hash algorithm. Since xxhash64 uses a fixed seed value (e.g., seed=0) in its default configuration, its hash outputs are predictable. Attackers could exploit this determinism to craft specific inputs that generate hash collisions.
Use Case
Impact
If aibrix's hash generation logic lacks randomization (e.g., no dynamic seeds or salting), attackers could leverage xxhash64's predictable nature to inject malicious inputs that collide with target prompts, causing cache pollution and subsequent response errors.
Proposed Solution
Fix Recommendation
In a cluster environment, this issue should be addressed by implementing statistically unique and cryptographically secure xxhash seed values.（not Like vllm GHSA-rm76-4mrf-v9r8 )This approach would:
Prevent attackers from predicting or forcing collisions.
Enable global cache sharing across the cluster while maintaining security.
issue:https://github.com/vllm-project/aibrix/issues/749
fix PR:https://github.com/vllm-project/aibrix/pull/752 |
|---|
| स्रोत | ⚠️ https://github.com/vllm-project/aibrix/issues/749 |
|---|
| उपयोगकर्ता | kexinoh (UID 82084) |
|---|
| सबमिशन | 27/02/2025 02:39 AM (2 साल पहले) |
|---|
| संयम | 04/03/2025 03:20 PM (6 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 298543 [vLLM AIBrix 0.2.0 Prefix Caching hash.go कमजोर एन्क्रिप्शन] |
|---|
| अंक | 20 |
|---|