Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Upgrade Pytorch Version #3515

Open
dhrubo-os opened this issue Feb 7, 2025 · 1 comment
Open

[FEATURE] Upgrade Pytorch Version #3515

dhrubo-os opened this issue Feb 7, 2025 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@dhrubo-os
Copy link
Collaborator

Is your feature request related to a problem?

Currently for local model, ml-commons is using Pytorch 1.13.1

But this version has multiple vulnerabilities:

  1. Use After Free Vulnerability:

Description: Improper memory handling in the interpreter.cpp component can lead to a use-after-free condition, potentially allowing attackers to execute arbitrary code or cause a denial of service.
Affected Versions: Versions prior to 2.2.0. (ref)

  1. Heap-based Buffer Overflow:

Description: A heap-based buffer overflow in the /runtime/vararg_functions.cpp component can be exploited by attackers to cause a crash or potentially execute arbitrary code by supplying crafted input.
Affected Versions: Versions prior to 2.2.0. (ref)

What solution would you like?

We should upgrade the pytorch version and make the corresponding changes in the code base to address that upgrade.

What alternatives have you considered?
A clear and concise description of any alternative solutions or features you've considered.

Do you have any additional context?
Add any other context or screenshots about the feature request here.

@dhrubo-os dhrubo-os added enhancement New feature or request untriaged labels Feb 7, 2025
@nathaliellenaa
Copy link
Contributor

Can I get assigned to this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants