vLLM Cross-User Data Leak Vulnerability in Inference Batches

The vLLM project has disclosed a medium-severity vulnerability, GHSA-7m6h-x95x-82q5, according to the GitHub Security Advisory database. This issue affects inference batches in vLLM versions prior to and including 0.21.0, as well as later versions where the affected code resides in a different file. The vulnerability arises from an integer overflow in the act_and_mul_kernel kernel, which can cause the output of one user's request to be incorporated into the response of another user's request within the same batch. Under specific conditions, such as when 2^32 is divisible by the parameter d, the last request in a batch may receive a partial or complete copy of the first user's inference result, leading to cross-user data leakage.

Operators should carefully evaluate their batch configurations and workloads before upgrading or continuing to use affected versions of vLLM. Specifically, batch size and sequence length settings that align with the conditions described in the proof-of-concept, such as a batch size of 17 and sequence length of 16384, may exacerbate the risk. If sensitive data is being processed, operators should consider isolating user requests into separate batches or applying patches if available. This vulnerability highlights the importance of scrutinizing kernel-level computations in AI inference systems, as integer overflows can lead to severe data leakage risks.