Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
flashinfer-ai/flashinfer
main @ 2f9a93b
7
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Out-of-bounds Read: 3 prior fixes. Scrutinize any change in this area.
flashinfer/gdn_kernels/gdn_decode_bf16_state.py: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Out-of-bounds Read: Negative slot indices in the padding state of GDN decode kernels can lead to out-of-bounds memory accesses on the GPU. Proper clamping of index values must be enforced prior to kernel launch.
Integer Overflow: GPU global memory addressing using element offsets calculated with standard 32-bit integers can overflow when processing large sequences. Widening these index calculations to Int64 prevents wrapping and subsequent out-of-bounds writes or reads.
Memory Corruption: FP4 quantization on unaligned matrix dimensions can trigger out-of-bounds memory writes if output scale factor buffers are not correctly padded. Strict alignment validation and rounding up of buffer sizes are necessary.