OneFlow Denial-of-Service Vulnerability via Invalid GPU Device Index

A denial-of-service vulnerability has been identified in OneFlow version 0.9.0. The issue arises from a device-ID validation flaw that allows attackers to cause a crash by calling the 'flow.cuda.synchronize()' function with an invalid or out-of-range GPU device index. This leads to a failure in the 'cudaSetDevice()' call, causing the application to abort and generate a core dump.

Impact

Exploiting this vulnerability leads to a crash of the OneFlow application, accompanied by a core dump.

Reproduction

The vulnerability can be reproduced by calling 'flow.cuda.synchronize()' with an invalid GPU device index, such as 5, when the maximum available device index is lower. This will trigger a failure in setting the device, causing the application to crash.