REDHAT-BUG-2491582: High severity vllm vllm vulnerability
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2491582?
The severity of REDHAT-BUG-2491582 is high, with a rating of 7.
How do I fix REDHAT-BUG-2491582?
To mitigate REDHAT-BUG-2491582, update vLLM to version 0.22.0 or later which includes fixes for the vulnerability.
What type of attack does REDHAT-BUG-2491582 allow?
REDHAT-BUG-2491582 allows unauthenticated attackers to achieve arbitrary code execution on the server.
What software is affected by REDHAT-BUG-2491582?
The software affected by REDHAT-BUG-2491582 is vLLM, specifically versions prior to 0.22.0.
What is the main issue in REDHAT-BUG-2491582?
The main issue in REDHAT-BUG-2491582 is an assert-based security check failure in vLLM's activation function loading.