$ the-wire · showcase
Executorch patches CWE-125 in Arm VGF decoder, PyTorch cleans up snapshots and CI
By RepoJournal · Filed · About PyTorch · Composed from the cited sources · methodology
16 people shipped this
Natalia Gimelshein
@ngimel
1 cited
Tristan Rice
@d4l3k
1 cited
Driss Guessous
@drisspg
1 cited
Elena Zhelezina
@wwwind
1 cited
shoumikhin
@shoumikhin
1 cited
Huy Do
@huydhn
Bob Ren
@bobrenjc93
karthickai
@karthickai
pzhan9
@pzhan9
SherlockNoMad
@SherlockNoMad
anijain2305
@anijain2305
YeonwooSung
@YeonwooSung
pytorchbot
@pytorchbot
bowang007
@bowang007
apbose
@apbose
bsprenger
@bsprenger
A memory-safety fix in the Arm backend's VGF decoder lands alongside a memory_snapshot correctness fix, Triton autotune compatibility work, and the removal of CUDA 13.0 from the TensorRT build matrix.
Arm backend: Fix for security bug reported by Metis, CWE-125 (#23363) pytorch/executorch
The Arm backend now validates the VGF header before deriving table decoder pointers; previously, "malformed VGF offsets can point outside the vgf_data buffer," per the Metis report. Treat this as a breaking-trust fix: rerun any builds or models that parse untrusted VGF files.
Report every mapped segment in a per-pool memory snapshot (#199845) pytorch/pytorch
memory_snapshot(mempool_id=...) used to drop part of any expandable segment containing an unmapped hole, which release_blocks can create during empty_cache. It now reports every mapped segment, so snapshots taken after cache release no longer silently omit allocations.
Bump attn-gym to 0.0.16 (#5069) pytorch/torchtitan
attn-gym 0.0.16 removes the unused T argument from the GDN local-dV kernel's autotune key, which Triton 3.9 validates at decoration time and rejected. Fused GDN backward on Triton 3.9 works again with no dependency pin changes.
Drop cu130 from the CUDA build matrix pytorch/TensorRT
The build matrix no longer builds cu130, following PyTorch's removal of CUDA 13.0 from nightly builds; cu132 is the supported channel. If you pin cu130 wheels downstream, move to cu132.
[FSDP] Reduce TestParityWithDDP GPU delays 250ms -> 50ms (#199769) pytorch/pytorch
The delay tests in TestParityWithDDP drop their injected torch.cuda._sleep from 250ms to 50ms per iteration, cutting roughly 410s of the class's ~917s per CI config. CUDA numeric-precision coverage across numerics modes is unchanged.
Action items
- → Upgrade executorch past the Arm VGF decoder fix if you parse untrusted VGF models pytorch/executorch [immediate]
- → Move off the cu130 TensorRT wheels to cu132, which is now the supported CUDA channel pytorch/TensorRT [plan]
