UCSD Hao AI Lab 披露 vLLM 流式会话越界写共享缓存漏洞
vLLM 流式会话越界写共享缓存漏洞
UCSD Hao AI Lab 指出 vLLM 存在静默越界写问题：流式输入时只校验每个新 chunk 的长度、不校验整个会话总长，超长会话的 token 数据会溢出到共享前缀缓存块，后续请求复用该块时输出被改变且无报错。作者称限制 worker 写入、丢弃超限 token 数据可修复，相关 PR 为 vllm-project/vllm#67457。
Hao AI Lab· @haoailab · X·2026-11-14 03:13· 37 分钟前AI 评分46
AI 导读
vLLM 存在静默越界写问题：流式输入时只校验每个新 chunk 的长度、不校验整个会话总长，超长会话的 token 数据会溢出到共享前缀缓存块，后续请求复用该块时输出被改变且无报错。限制 worker 写入、丢弃超限 token 数据可修复，PR 见 vllm-project/vllm#67457。
正文 · 原文
(4/7) Silent out-of-bounds write: a long streaming session overwrites a shared cache block.
This breaks memory isolation: a request must never write outside its own memory.
With streaming input, vLLM checks each new chunk's length but not the whole session's, so a session can exceed the model's maximum length. vLLM reserves no memory for those extra tokens, so their data spills outside the session's memory and can land in a shared cache block. A later request reusing that block can get different output, with no error.
A long streaming session past the model's length limit overwrote a shared prefix cache block. Bounding the worker write prevents that, dropping token data past the limit.
PR: github.com/vllm-project/vllm/…
来源：Hao AI Lab · x.com
来源：RadarAI · aihot.news