| शीर्षक | kvcache-ai mooncake mooncake-transfer-engine==0.3.11.post1 Access Control |
|---|
| विवरण | Mooncake Store does not verify that the Transfer Engine endpoint and memory range supplied in a MountSegment request belong to the calling client.
An attacker who can access the Mooncake Store Master can register a new segment that names another client's real Transfer Engine endpoint and an address inside that client's registered memory. The attacker can then select the forged segment as the preferred destination of a normal Store Put. Mooncake allocates the object at the forged address and instructs Transfer Engine to write the attacker's data to the victim endpoint.
I reproduced this behavior with two independent Linux processes and two separate MooncakeDistributedStore clients. The attacker learned the victim's address and endpoint through the Master's unauthenticated HTTP administration interface. After the attacker completed a normal preferred-segment Put, the victim read its original key and received the attacker's payload. Mooncake still reported the victim replica as ReplicaStatus.COMPLETE.
The demonstrated impact is a cross-client integrity violation. The attack does not require victim process access, configuration modification, a shared process, or prior knowledge of the victim's memory address. |
|---|
| स्रोत | ⚠️ https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438 |
|---|
| उपयोगकर्ता | YYYMK (UID 100105) |
|---|
| सबमिशन | 24/07/2026 08:20 PM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 06:01 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409018 [kvcache-ai mooncake तक 0.3.12/0.3.13.post1/0.3.14-rc1 MountSegment Request Processing segment.cpp अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|