| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| lmdeploy | ≥ 0.9.2, < 0.16.0 | 0.16.0 |
LMDeploy's PyTorch DistServe/PD-disaggregation control plane used
recv_pyobj() to deserialize messages received through a ZeroMQ PULL
socket. PyZMQ implements recv_pyobj() using Python pickle
deserialization, which can execute arbitrary code while reconstructing
an object.
The peer address used by the receiver was supplied through the
POST /distserve/p2p_connect HTTP endpoint. An attacker who could reach
an affected DistServe API server could cause the server to connect to an
attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle
payload.
API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process.
This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow.
lmdeploy/serve/openai/endpoints/distserve.py,
POST /distserve/p2p_connectDistServeConnectionRequest.remote_engine_endpoint_info.zmq_addresslmdeploy/pytorch/disagg/conn/engine_conn.py,
EngineP2PConnection.handle_zmq_recv()recv_pyobj(), which performs pickle deserializationhandle_zmq_recv() receives messages using recv_pyobj().A type check performed after recv_pyobj() cannot mitigate this issue
because pickle payload execution occurs during deserialization.
Successful exploitation allows arbitrary code execution as the LMDeploy serving process. This can expose model weights, prompts, credentials, attached storage, cluster-network services, and host or GPU resources. An attacker may also modify or terminate the serving process.
Affected versions:
lmdeploy >= 0.9.2, < 0.16.0The vulnerable P2P receiver was introduced in commit b0b705f7.
The issue was fixed by replacing the pickle-based ZeroMQ protocol with JSON serialization:
send_pyobj() was replaced with send_json().recv_pyobj() was replaced with recv_json().DistServeCacheFreeRequest Pydantic schema before use.Fix commit:
The fix was released in LMDeploy 0.16.0.
Users who cannot upgrade immediately should:
/distserve/* endpoints.These measures reduce exposure but do not make pickle deserialization safe. Upgrading to LMDeploy 0.16.0 or later is recommended.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí