OneFlow Type Validation Vulnerability in flow.dstack() Component Leading to Denial-of-Service

A type validation vulnerability has been identified in OneFlow version 0.9.0, specifically within the flow.dstack() component. This flaw allows attackers to cause a denial-of-service by exploiting a type mismatch, which leads to a segmentation fault and a core dump.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a denial-of-service condition where the application crashes and requires a restart.

Reproduction

The vulnerability can be reproduced by calling the flow.dstack() function with a list of tensors that includes a NumPy array. This input causes a type mismatch that results in a segmentation fault.