Lucene search

Veracode Vulnerability DatabaseVERACODE:46562

HistoryApr 22, 2024 - 6:30 a.m.

Out-Of-Bounds Read

2024-04-2206:30:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

pytorch

out-of-bounds read

flatbufferloader

memory corruption

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Pytorch is vulnerable to an Out-of-bounds Read. The vulnerability is caused due to a missing validation for mobile_ivalue_size_ variable for a value greater than ivalues->size() in function FlatbufferLoader::parseModule within torch/csrc/jit/mobile/flatbuffer_loader.cpp. This introduces potential for memory corruption when parsing the mobile_bytecode Module.

CPENameOperatorVersion
torchle2.1.2
torchle2.1.2

CPE	Name	Operator	Version
	torch	le	2.1.2
	torch	le	2.1.2

References

github.com/pytorch/pytorch/blob/v2.1.2/torch/csrc/jit/mobile/flatbuffer_loader.cpp#L305

github.com/pytorch/pytorch/commit/7c35874ad664e74c8e4252d67521f3986eadb0e6