Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
intel/ipex-llm
main @ de6bce2
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Dependency Confusion: 1 prior fix. Scrutinize any change in this area.
docker/llm/serving/cpu/docker/Dockerfile: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Dependency Confusion: Using '--extra-index-url' in pip install commands allows attackers to register identical package names on public repositories (like PyPI) and force target machines to download malicious payloads instead of internal dependencies like 'oneccl_bind_pt'.
Integer Overflow: Using 'c_int' instead of 'c_size_t' for tensor sizes in ctypes bindings causes integer overflows when processing extremely large LLM parameters (e.g., Bloom-176B), potentially leading to out-of-bounds memory access during native tensor quantization operations.