PyTorch Memory Corruption Vulnerability in Profiler Callback Function

A critical memory corruption vulnerability has been identified in PyTorch versions 2.6.0 and later with CUDA 12.4. The issue arises in the Tuple Handler component, specifically within the function 'torch.ops.profiler._call_end_callbacks_on_jit_fut'. The vulnerability is triggered by passing a tuple containing a None value, which leads to a segmentation fault. This vulnerability can be exploited remotely, although the attack complexity is considered high.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a denial of service condition by crashing the application.

Reproduction

To reproduce this vulnerability, use PyTorch version 2.6.0 with CUDA 12.4. Call the function 'torch.ops.profiler._call_end_callbacks_on_jit_fut' with a tuple that includes a None value. This will result in a segmentation fault, crashing the application.