| 제목 | kvcache-ai mooncake mooncake-transfer-engine==0.3.11.post1 Access Control |
|---|
| 설명 | Mooncake Store does not verify that the Transfer Engine endpoint and memory range supplied in a MountSegment request belong to the calling client.
An attacker who can access the Mooncake Store Master can register a new segment that names another client's real Transfer Engine endpoint and an address inside that client's registered memory. The attacker can then select the forged segment as the preferred destination of a normal Store Put. Mooncake allocates the object at the forged address and instructs Transfer Engine to write the attacker's data to the victim endpoint.
I reproduced this behavior with two independent Linux processes and two separate MooncakeDistributedStore clients. The attacker learned the victim's address and endpoint through the Master's unauthenticated HTTP administration interface. After the attacker completed a normal preferred-segment Put, the victim read its original key and received the attacker's payload. Mooncake still reported the victim replica as ReplicaStatus.COMPLETE.
The demonstrated impact is a cross-client integrity violation. The attack does not require victim process access, configuration modification, a shared process, or prior knowledge of the victim's memory address. |
|---|
| 원천 | ⚠️ https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438 |
|---|
| 사용자 | YYYMK (UID 100105) |
|---|
| 제출 | 2026. 07. 24. PM 08:20 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 23. PM 06:01 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 409018 [kvcache-ai mooncake 까지 0.3.12/0.3.13.post1/0.3.14-rc1 MountSegment Request Processing segment.cpp 권한 상승] |
|---|
| 포인트들 | 20 |
|---|