Listen to this Post
An integer overflow in the `act_and_mul_kernel` kernel within vLLM can cause the output of one user request to be incorporated into the response of another request within the same inference batch. The root cause is an integer overflow in the expression `blockIdx.x 2 d` at csrc/activation_kernels.cu. As a result, the computation for one user (User A) can incorrectly consume input data from another user (User B). In particular, when `2^32` is divisible by d, the overflow can cause User A’s output to contain portions of User B’s inference result. In some cases, User B’s response may be copied entirely into User A’s response. This constitutes a severe cross-user information disclosure vulnerability and is straightforward to trigger. The issue was reproduced using meta-llama/Llama-3.2-1B-Instruct, for which d = 8192. Using a batch size of 17 and a sequence length of 16384, the final response in the batch becomes an exact copy of the first response, demonstrating complete cross-user data leakage. This vulnerability enables an attacker to intentionally craft requests that are processed within the same inference batch as a victim’s request, causing the victim’s inference output to be copied into the attacker’s response. For versions prior and equal to 0.21.0, the bug is in csrc/activation_kernels.cu, and for versions later than 0.21.0, the bug is in csrc/libtorch_stable/activation_kernels.cu.
DailyCVE Form:
Platform: vLLM
Version: < 0.27.0
Vulnerability: Integer Overflow
Severity: Medium
date: 2026-08-13
Prediction: 2026-08-13
What Undercode Say:
Check vLLM version pip show vllm | grep Version Check for vulnerable file find / -name "activation_kernels.cu" 2>/dev/null | xargs grep -n "blockIdx.x 2 d"
The vulnerability resides in the CUDA kernel code. The unsafe integer multiplication `blockIdx.x 2 d` can overflow when the product exceeds 2^32 - 1. In multi-tenant environments, this allows cross-user data leakage where one user’s request may receive partial or complete results intended for another user.
Exploit: (Educational Purposes!)
To trigger the vulnerability, an attacker would need to:
1. Submit inference requests that are batched together with a victim’s request
2. Ensure the batch configuration causes the integer overflow condition
3. The PoC uses batch size 17 and sequence length 16384 with `d = 8192`
Conceptual exploit setup This is for educational purposes only batch_size = 17 seq_len = 16384 When d = 8192 and 2^32 % d == 0, overflow occurs
Protection:
Upgrade vLLM to version 0.27.0 or later. Until patching is possible, consider disabling batch processing or implementing request isolation to prevent multiple users’ requests from being processed together in the same inference batch.
Impact:
This vulnerability enables cross-user information disclosure. An attacker can intentionally craft requests that are processed within the same inference batch as a victim’s request and cause the victim’s inference output to be copied into the attacker’s response. As a result, sensitive information contained in another user’s model response may be exposed to an unauthorized party.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
