Ò»¡¢¡¢¡¢·ì϶¸ÅÊö
·ì϶Ãû³Æ | vLLM auto_map ¶¯Ì¬Ä£¿£¿£¿éÔ¶³Ì´úÂëÖ´Ðзì϶ |
CVE ID | CVE-2026-22807 |
·ì϶ÀàÐÍ | RCE | ·¢ÏÖ¹¦·ò | 2026-01-22 |
·ì϶ÆÀ·Ö | 8.8 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ±ØÒª |
PoC/EXP | δ¹«¿ª | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
vLLMÊÇÒ»¸ö¸ß»úÄܵĴóÄ£ÐÍÍÆÀí¿ò¼Ü£¬£¬£¬×¨Îª´ó¹æģ˵»°Ä£Ð͵ĸßÍÌÍÂÁ¿¡¢¡¢¡¢µÍÑÓ³¤²¿Êð¶øÉè¼Æ¡£¡£¡£ÆäÖ÷Ìâ¸öÐÔÔ̺¬PagedAttention¸ßЧÄÚ´æÖÎÀí¡¢¡¢¡¢²¢Ðл¯µ÷¶ÈÓÅ»¯ÒÔ¼°¶Ô¶àGPU¡¢¡¢¡¢É¢²¼Ê½»·¾³µÄÓÅÁ¼Ö§³Ö¡£¡£¡£vLLM¼æÈÝHugging Face½Ó¿Ú£¬£¬£¬±ãÓÚÄ£Ðͼ±¾ç¼ÓÔØÓ뼯³É£¬£¬£¬¿í·ºÓÃÓÚÍÆÀí·þÎñ¡¢¡¢¡¢AIÀûÓúó¶ËÓë³ö²ú¼¶Ä£ÐͲ¿Ê𳡾°¡£¡£¡£
2026Äê1ÔÂ22ÈÕ£¬£¬£¬OG¶«·½Ìü¼¯ÍÅVSRC¼à²âµ½vLLMÔÚÄ£Ðͳõʼ»¯½×¶Î´æÔÚµÄÒ»ÏîÔ¶³Ì´úÂëÖ´Ðзì϶¡£¡£¡£¸Ã·ì϶ԴÓÚvLLMÔÚ½âÎöÄ£ÐÍÅäÖÃʱ£¬£¬£¬ÎÞÇ°Ìá¼ÓÔØHugging FaceÄ£ÐÍÖеÄauto_map¶¯Ì¬Ä£¿£¿£¿é£¬£¬£¬ÇÒδ¶Ôtrust_remote_codeÑ¡Ïî½øÐÐÓÐЧУÑé¡£¡£¡£¹¥»÷ÕßÒ»µ©¿ÉÄܽÚÖÆÄ£ÐͲֿâõ辶£¨±¾µØĿ¼»òÔ¶³Ì²Ö¿â£©£¬£¬£¬¼´¿ÉÔÚÄ£ÐͼÓÔعý³ÌÖÐ×¢Èë²¢Ö´ÐÐËÁÒâPython´úÂë¡£¡£¡£¸ÃÐÐΪ²úÉúÔÚ·þÎñÆô¶¯½×¶Î£¬£¬£¬ÒªÇó´¦ÖÃ֮ǰ£¬£¬£¬ÎÞÐèÈκνӿڽӼûȨÏÞ£¬£¬£¬·çÏսϸߣ¬£¬£¬¿ÉÄÜÖ±½Óµ¼ÖÂËÞÖ÷ϵͳ±»ÆëÈ«½ÚÖÆ¡£¡£¡£
¶þ¡¢¡¢¡¢Ó°ÏìÁìÓò
0.10.1 <= vLLM < 0.14.0¡£¡£¡£
Èý¡¢¡¢¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
¹Ù·½ÒÑ°ä²¼ÐÞ¸´°æ±¾£¬£¬£¬½¨ÒéÓû§Éý¼¶
ÏÂÔØÁ´½Ó£º£ºhttps://github.com/vllm-project/vllm/releases/
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£¡£¡£
3.3 ͨÓý¨Òé
? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¡£¡£¬£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÖÆ£¬£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬£¬¹Ø±Õ·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢¡¢¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£? ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÖƺÍ×îСȨÏÞ×¼Ôò£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://nvd.nist.gov/vuln/detail/CVE-2026-22807https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr
¾©¹«Íø°²±¸11010802024551ºÅ