OneFlow Segmentation Fault Vulnerability in Logical OR Component Allowing Denial-of-Service

A segmentation fault vulnerability has been identified in OneFlow version 0.9.0, specifically within the logical_or component. This vulnerability allows attackers to cause a denial-of-service condition by sending crafted input that triggers the segmentation violation.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing a denial-of-service condition by crashing the application.

Reproduction

The vulnerability can be reproduced by creating two tensors with boolean data types using invalid string inputs, and then calling the logical_or method on these tensors. This sequence of actions triggers a segmentation fault, which is indicative of the vulnerability.