| शीर्षक | tile-ai tilelang main Remote Code Executio |
|---|
| विवरण | TileLang contains an unsafe deserialization vulnerability in its kernel cache system. The software uses cloudpickle (a superset of Python pickle) to serialize and deserialize kernel parameters and compiled function objects to and from disk. An attacker who can write files to the TILELANG_CACHE_DIR directory (default: ~/.tilelang/cache) can craft a malicious pickle file that executes arbitrary Python code via the cloudpickle.load() reduce protocol when a victim loads a cached kernel. This affects KernelCache._load_kernel_from_disk (tilelang/cache/kernel_cache.py:595) and AutotuneResult._load_kernel_from_disk / load_from_disk (tilelang/autotuner/param.py:368, 497).
|
|---|
| स्रोत | ⚠️ https://github.com/tile-ai/tilelang/issues/2817 |
|---|
| उपयोगकर्ता | Customeres (UID 86596) |
|---|
| सबमिशन | 30/07/2026 05:58 PM (1 महीना पहले) |
|---|
| संयम | 08/09/2026 09:24 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 400289 [tile-ai tilelang तक 0.1.14 Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|