PyTorch Buffer Overflow Vulnerability in nn.Fold Component Allowing Denial-of-Service

A buffer overflow vulnerability has been identified in PyTorch versions prior to 2.7.0, specifically when the inductor compiler is used. This vulnerability occurs in the nn.Fold function, where an assertion error is thrown, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by triggering a buffer overflow error in the nn.Fold function.

Reproduction

The vulnerability can be reproduced by compiling a PyTorch model that includes the nn.Fold component using the inductor backend. This will result in an assertion error being thrown, indicating a buffer overflow issue.

Remediation

Users can upgrade to PyTorch version 2.7.0 or later, where this vulnerability has been fixed.