PyTorch Denial-of-Service Vulnerability in Tensor Conversion Functions

A denial-of-service vulnerability has been identified in PyTorch version 2.7.0. The issue arises when a model uses the combination of `torch.Tensor.to_sparse()` and `torch.Tensor.to_dense()` functions, and is compiled with the Inductor backend. This combination leads to a `NotImplementedError`, causing the application to crash and creating a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by crashing the application.

Reproduction

The vulnerability can be reproduced by creating a PyTorch model that includes the `torch.Tensor.to_sparse()` and `torch.Tensor.to_dense()` functions. When this model is compiled using the Inductor backend, it will throw a `LoweringException` with a `NotImplementedError`, indicating that the operation could not be completed. This error can be observed by running the model with the specified tensor conversion functions under the Inductor backend, which will result in a crash.

Remediation

This vulnerability has been fixed in PyTorch version 2.7.1. Users can upgrade to this version to address the issue.