提交 #904605: kvcache-ai mooncake mooncake-transfer-engine==0.3.11.post1 Access Control

Mooncake Store does not verify that the Transfer Engine endpoint and memory range supplied in a MountSegment request belong to the calling client.

An attacker who can access the Mooncake Store Master can register a new segment that names another client's real Transfer Engine endpoint and an address inside that client's registered memory. The attacker can then select the forged segment as the preferred destination of a normal Store Put. Mooncake allocates the object at the forged address and instructs Transfer Engine to write the attacker's data to the victim endpoint.

I reproduced this behavior with two independent Linux processes and two separate MooncakeDistributedStore clients. The attacker learned the victim's address and endpoint through the Master's unauthenticated HTTP administration interface. After the attacker completed a normal preferred-segment Put, the victim read its original key and received the attacker's payload. Mooncake still reported the victim replica as ReplicaStatus.COMPLETE.

The demonstrated impact is a cross-client integrity violation. The attack does not require victim process access, configuration modification, a shared process, or prior knowledge of the victim's memory address.

• 来源: ⚠️ https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438
• 用户: YYYMK (UID 100105)
• 提交: 2026-07-24 20時20分 (2 月前)
• 管理: 2026-09-23 18時01分 (2 months later)
• 状态: 已接受
• VulDB条目: 409018 [kvcache-ai mooncake 直到 0.3.12/0.3.13.post1/0.3.14-rc1 MountSegment Request Processing segment.cpp 权限提升]
• 积分: 20