vllm-project / vllm-project/aibrix

release-0.2 still uses unseeded xxhash in PrefixHashTable (CVE-2025-1953)

Open
#2,148 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
5.1k
Forks
694
Avg merge
1d 20h
Merged PRs (30d)
98

Description

`pkg/plugins/gateway/prefixcacheindexer/hash.go` on `release-0.2` still calls `xxhash.Sum64(IntArrayToByteArray(chunk))` directly inside `MatchPrefix` and `AddPrefix` -- there's no `xxhash.NewWithSeed`, no random `seed` field on `PrefixHashTable`, and no `math/rand` import.

Upstream commit [`3d25d95a`](https://github.com/vllm-project/aibrix/commit/3d25d95aebd66f24a549200edcebc5ea423b317a) (*Use random seed for xxhash*) is the fix advertised for **CVE-2025-1953**. It introduces a per-instance random seed (`r := rand.New(rand.NewSource(time.Now().Unix())); seed := r.Uint64()`) wired through `xxhash.NewWithSeed(seed)` so the prefix-cache hash table is no longer keyed by an attacker-predictable hash.

Without that, a request issuer that can guess the hash function can craft inputs that collide on the cache key, which is the scenario the CVE describes. This branch may want a backport, even if the import path also needs the `aibrix/aibrix -> vllm-project/aibrix` migration touched up. -- `vulgraph`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.