CVE-2025-65886

Executive Summary

CVE-2025-65886 is a Denial of Service (DoS) vulnerability in OneFlow v0.9.0, an open-source deep learning framework. The flaw arises from a shape mismatch vulnerability that allows an attacker to supply crafted tensor shapes, causing the framework to crash or become unresponsive. This can be exploited remotely without authentication, leading to service disruption. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the impact is significant for production ML pipelines. No public exploit code or patch is currently available.

Supply Chain & Package Security

OneFlow is distributed via PyPI (oneflow). Users should verify package integrity using checksums and monitor for malicious updates. The vulnerability affects the core tensor handling logic, which is a critical component for model inference and training.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder/unassigned)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium (due to DoS impact and lack of patch)

Deep Dive & Mechanics

OneFlow v0.9.0 uses a tensor shape validation mechanism that does not properly handle mismatched dimensions. When an attacker sends a crafted tensor with inconsistent shape parameters (e.g., a 2D tensor with mismatched row/column counts), the framework attempts to allocate memory or perform operations based on the invalid shape, leading to a segmentation fault or infinite loop. The vulnerability is in the Tensor::Reshape or Tensor::FromBuffer functions, which lack proper bounds checking.

The attack can be triggered via the OneFlow Python API by passing a malformed shape tuple to operations like flow.reshape() or flow.tensor(). For example:

import oneflow as flow
# Crafted shape with mismatch
t = flow.tensor([1, 2, 3], shape=(2, 2))  # 3 elements but shape expects 4

Vulnerable vs. Patched Code

Vulnerable Code (OneFlow v0.9.0):

// tensor_impl.cpp
TensorImpl::TensorImpl(const Shape& shape, DataType dtype) {
    // No validation of shape consistency
    size_ = shape.Count();
    data_ = new char[size_ * GetDataTypeSize(dtype)];
}

Patched Code (hypothetical fix):

// tensor_impl.cpp
TensorImpl::TensorImpl(const Shape& shape, DataType dtype) {
    if (shape.Count() == 0 || shape.Count() > MAX_TENSOR_SIZE) {
        throw std::invalid_argument("Invalid shape dimensions");
    }
    size_ = shape.Count();
    data_ = new char[size_ * GetDataTypeSize(dtype)];
}

Exploitation & Lab Setup

Red Team

1. Setup: Install OneFlow v0.9.0 in a Python environment.
2. Exploit: Send crafted tensor shapes via the API.
3. Payload:

import oneflow as flow
import numpy as np

# Trigger shape mismatch
try:
    t = flow.tensor(np.array([1, 2, 3]), shape=(2, 2))
except Exception as e:
    print(f"Error: {e}")
# This will cause a crash or hang

Blue Team

1. Detection: Monitor for repeated tensor shape errors in logs.
2. Mitigation: Restrict access to OneFlow API endpoints.
3. Honeypot: Deploy a fake OneFlow service to capture exploit attempts.

Indicators of Compromise (IOCs)

• Log Entries: Repeated shape mismatch or invalid shape errors in OneFlow logs.
• Network Traffic: Unusual API calls with malformed shape parameters.
• Process Behavior: OneFlow process crashes or hangs unexpectedly.
• File Artifacts: Core dump files in /tmp/ or application directory.

Detection Engineering

YARA Rule

rule CVE_2025_65886_OneFlow_DoS {
    meta:
        description = "Detects OneFlow tensor shape mismatch exploit attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65886"
    strings:
        $s1 = "shape" ascii wide nocase
        $s2 = "reshape" ascii wide nocase
        $s3 = "tensor" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: OneFlow Tensor Shape Mismatch DoS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-65886 via malformed tensor shapes
author: Valters IT
logsource:
    product: oneflow
    service: application
detection:
    selection:
        EventID: 1001
        Message|contains: "shape mismatch"
    condition: selection
falsepositives:
    - Legitimate shape errors during development
level: medium

Suricata Rule

alert tcp any any -> any 8080 (msg:"CVE-2025-65886 OneFlow Tensor Shape DoS Attempt"; flow:to_server; content:"shape"; nocase; content:"reshape"; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or restrict access to OneFlow API endpoints until a patch is available.
2. Short-term: Implement input validation for tensor shapes at the application layer.
3. Long-term: Upgrade to a patched version of OneFlow once released.
4. Workaround: Use a reverse proxy to filter malformed requests.
5. Monitoring: Enable detailed logging for tensor operations and alert on anomalies.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert