提出 #904605: kvcache-ai mooncake mooncake-transfer-engine==0.3.11.post1 Access Control

Mooncake Store does not verify that the Transfer Engine endpoint and memory range supplied in a MountSegment request belong to the calling client.

An attacker who can access the Mooncake Store Master can register a new segment that names another client's real Transfer Engine endpoint and an address inside that client's registered memory. The attacker can then select the forged segment as the preferred destination of a normal Store Put. Mooncake allocates the object at the forged address and instructs Transfer Engine to write the attacker's data to the victim endpoint.

I reproduced this behavior with two independent Linux processes and two separate MooncakeDistributedStore clients. The attacker learned the victim's address and endpoint through the Master's unauthenticated HTTP administration interface. After the attacker completed a normal preferred-segment Put, the victim read its original key and received the attacker's payload. Mooncake still reported the victim replica as ReplicaStatus.COMPLETE.

The demonstrated impact is a cross-client integrity violation. The attack does not require victim process access, configuration modification, a shared process, or prior knowledge of the victim's memory address.

• ソース: ⚠️ https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438
• ユーザー: YYYMK (UID 100105)
• 送信: 2026年07月24日 20:20 (2 月 ago)
• モデレーション: 2026年09月23日 18:01 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 409018 [kvcache-ai mooncake 迄 0.3.12/0.3.13.post1/0.3.14-rc1 MountSegment Request Processing segment.cpp 特権昇格]
• ポイント: 20