High

vLLM MessageQueue Pickle Deserialization RCE Attempt

vLLM, a popular AI inference engine, has a flaw where it deserializes untrusted data from its internal message queue using Python's pickle module. Anyone able to reach that queue can send a crafted object that runs arbitrary commands on the server, no authentication needed.

How the attack works

vLLM's MessageQueue.dequeue() function reads bytes off a socket and passes them straight to pickle.loads() without checking what they contain. An attacker builds a pickle payload containing a code-execution gadget - typically a Python object with a __reduce__ method calling os.system or subprocess, or an equivalent raw pickle opcode sequence - and delivers it to a vLLM MessageQueue or ZeroMQ endpoint. When the engine deserializes the payload, the embedded command runs with the privileges of the inference process. This is tracked as CVE-2024-9052.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
6f0d1c3a-9b47-4e21-8a5c-2d7f4b9e13c8
Severity
High

Why it matters

An attacker who can reach the vLLM message queue gets arbitrary code execution on the host running the model, which can lead to full compromise of the inference server, theft of model weights or data, and a foothold to pivot into the rest of the environment.

What you can do

  • →Upgrade vLLM past the version affected by CVE-2024-9052 or apply the vendor's fix for pickle-based message queue deserialization.
  • →Never expose the vLLM MessageQueue or its ZeroMQ endpoints to untrusted networks; restrict access to localhost or a private, authenticated network segment.
  • →Run inference engines with least-privilege service accounts so a code-execution bug cannot escalate to full host compromise.
  • →Review command-line and process launch logs for pickle-related payloads combined with references to vLLM, MessageQueue, or ZeroMQ, especially from processes that shouldn't be spawning subprocesses.

Known benign look-alikes

  • Security researchers or vLLM maintainers reproducing CVE-2024-9052 with a local proof-of-concept one-liner against a throwaway inference instance.
  • Purple-team, CTF or exploit-development work where the operator knowingly crafts a __reduce__ gadget and pushes it over ZeroMQ.
  • Distributed ML plumbing (Ray/Dask-style workers, custom shm_broadcast harnesses) that pickles objects onto a tcp:// or ipc:// socket in an inline python -c snippet and happens to reference __setstate__ in the same line.
  • Debug snippets that round-trip a MessageQueue payload through pickle.loads() while also shelling out via subprocess in the same command.

References