Database/AI/ML frameworks & serving
ExLlamaV3: model-supplied kernel index is used unchecked, allowing out-of-bounds CUDA kernel dispatch at load time
Impact
A model file that an operator loads into ExLlamaV3 controls an index used to pick a CUDA kernel, and the index is not bounds-checked before the function pointer is called. The reliable outcome is a crash of the serving process during model load; CERT/CC notes that with certain host memory layouts an attacker may be able to steer the indirect dispatch, which would mean attacker-influenced code paths inside the process that already holds the GPU context. On a fleet where tenants or users supply their own quantized weights, this turns "upload a model" into an attack on the inference worker rather than a harmless parse failure. Any secrets the worker holds - registry credentials, other tenants' prompts in flight - sit in that address space.
Who can reach it
Anyone who can get a model file loaded by the ExLlamaV3 worker: a tenant uploading quantized weights, or a pipeline pulling a community EXL3 checkpoint from a public hub. No authentication to the GPU host is needed, only influence over which model file is loaded.
What to do
Pull the fix from upstream pull request 310 (bounds-check the kernel index) and restart the inference workers - no node drain or reboot, but every process serving an ExLlamaV3 model has to be recycled. Until then, load only EXL3 checkpoints you produced or verified yourself, and treat third-party quantizations as untrusted input. The record names no tagged release containing the fix.
References
Related entries
- SGLang: unauthenticated pickle deserialization on /update_weights_from_tensor gives code executionCVE-2026-86793 · SGLang inference server (/update_weights_from_tensor, SafeUnpickler)Unscored
- Jupyter Notebook (untrusted notebooks): Untrusted notebook executes JavaScript in the user's session on openCVE-2021-32798 · Jupyter Notebook (untrusted notebooks)Critical
- MLflow: Absolute path traversal prior to 2.5.0CVE-2023-3765 · MLflowCritical
- TorchServe: Unauthenticated SSRFCVE-2023-43654 · TorchServeCritical
- BentoML: Insecure deserializationCVE-2024-2912 · BentoMLCritical
- llama.cpp (RPC backend): Unsafe `data` pointer in `rpc_tensor`CVE-2024-42479 · llama.cpp (RPC backend)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.