# vLLM Mooncake Deserialization RCE - Inference Server Spawns Execution Primitive

- **Severity:** High
- **Signature ID:** `4f6c1d9e-8a72-4b31-9c5e-2d1a7f0b6e84`

## Summary

This rule flags a vLLM or Mooncake inference server process that suddenly launches a shell, reverse shell, or a download-and-execute command. That behaviour matches what would happen after a known deserialization flaw in the Mooncake KV-cache transport is exploited to run attacker code.

## How the attack works

vLLM's Mooncake integration binds a ZMQ/TCP transport on all interfaces to move KV-cache data between servers. That transport deserializes incoming data without validating it, so a crafted payload sent to it can trigger arbitrary code execution inside the server process. The rule cannot see the network payload itself, so instead it watches for the resulting process behaviour: a child process spawned by a process whose launch command clearly identifies it as a vLLM or Mooncake server (e.g. "vllm serve", mooncake_master, kv_transfer_config, VLLM_* environment variables). It then checks whether that child command is something an inference server has no legitimate reason to run — a reverse shell, curl/wget piped into an interpreter, base64 decode piped into an interpreter, netcat/socat with exec, cron or SSH-key persistence, or execution from a world-writable directory. Weaker matches are only reported if the child also writes to a staging or persistence location within five minutes, giving the analyst corroborating evidence.

## Why it matters

Successful exploitation gives an attacker code execution on the machine running the inference server, which can lead to data theft, lateral movement, or full host compromise. Since this rule only detects the after-the-fact process spawn, it does not confirm the exploit before code has already run.

## What you can do

- Restrict the Mooncake/ZMQ KV-cache transport to trusted internal network segments; never expose it on all interfaces to the open network.
- Run vLLM/Mooncake serving processes with least privilege and without write access to world-writable or persistence-relevant directories.
- Monitor for shells, download-and-execute commands, or SSH-key/cron changes spawned by inference server processes and treat them as suspicious.
- Keep vLLM and Mooncake components patched and track vendor advisories on deserialization issues in the KV-cache transport.

## Known benign look-alikes

- Container entrypoint scripts that run "curl ... | bash" or "pip install" bootstrap steps. Mitigated because the vLLM/Mooncake marker must appear on an ANCESTOR invocation, and a typical entrypoint installs packages before launching the server, so no marker exists yet.
- torch.compile / Triton / DeepGEMM JIT compilation, which spawns "sh -c" with nvcc, g++, ld or ninja from a vLLM worker. None of these match the anchor patterns.
- Python multiprocessing / resource_tracker workers (python -c "from multiprocessing.spawn import spawn_main; ..."). Deliberately excluded - inline-interpreter matching requires socket+connect, pickle+loads, or os.system/os.popen.
- Ray or Kubernetes cluster launchers that bootstrap workers with "bash -c" plus a remote fetch. Reported at MEDIUM only, and only if the child also writes into /dev/shm, /var/tmp, ~/.ssh, cron or a system binary directory.
- Model-weight or tokenizer downloads issued with curl/wget by the serving process. These are tier B and are suppressed unless a persistence/staging write is also present.
- Legitimate operator debugging inside the model server container (nc, socat, bash -i during an incident). Expect these during on-call sessions; correlate with change tickets.
- Process nodes in the graph are keyed by executable path, so CONNECTS/WRITE_FILE edges on a shared binary such as /usr/bin/curl may belong to another invocation. Mitigated by requiring every corroborating edge timestamp to fall inside the 5 minute trigger window.

## References

- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
- https://cwe.mitre.org/data/definitions/502.html
- https://docs.vllm.ai/en/latest/features/disagg_prefill.html

---
Source: https://www.netzilo.com/threats/vllm-mooncake-deser-rce