OneFlow GPU Device-ID Validation Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in OneFlow version 0.9.0. The issue arises in the 'flow.cuda.get_device_capability()' component, where an invalid GPU device ID can be used to cause a crash. This occurs because the 'cudaSetDevice()' function fails when presented with an invalid device ordinal, leading to an application abort and a core dump.

Impact

Exploitation of this vulnerability causes the application to crash, aborting the process and generating a core dump.

Reproduction

The vulnerability can be reproduced by calling the 'flow.cuda.get_device_capability()' function with an invalid device ID, such as 5, which exceeds the range of available device IDs. This will trigger a failure in the 'cudaSetDevice()' call, resulting in a crash and a core dump.