CVE-2025-65890

Executive Summary

CVE-2025-65890 is a denial-of-service (DoS) vulnerability in OneFlow v0.9.0, an open-source deep learning framework. The flaw resides in the flow.cuda.synchronize() function, which fails to validate the GPU device index provided by the caller. An attacker can trigger a crash or hang by passing an invalid or out-of-range device ID, leading to a complete denial of service for any process using the vulnerable API. No patch is currently available, and no public exploit code has been released. The vulnerability is classified under MITRE ATT&CK tactic T1499 (Endpoint Denial of Service) and CWE-20 (Improper Input Validation).

Supply Chain & Package Security

OneFlow is distributed via PyPI (oneflow). Users who install or update the package from PyPI are directly affected. The vulnerability exists in the core CUDA runtime module, meaning any application that imports OneFlow and calls flow.cuda.synchronize() with attacker-controlled input is at risk. Supply chain risk is elevated because the package is widely used in machine learning pipelines and may be pulled automatically by CI/CD systems or container builds.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, likely due to incomplete or missing vector data. Based on the vulnerability characteristics, a reasonable estimated vector would be:

• Attack Vector (AV): Local (L) – requires the ability to call the function with a crafted argument.
• Attack Complexity (AC): Low (L) – no special conditions needed.
• Privileges Required (PR): Low (L) – attacker needs code execution in the context of the OneFlow process.
• User Interaction (UI): None (N) – no user action required beyond the call.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – complete denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Estimated Base Score: 5.5 (Medium)

Threat Level: Medium – DoS only, but easy to exploit if an attacker has local access.

Deep Dive & Mechanics

The vulnerability is a classic input validation failure. In OneFlow v0.9.0, the flow.cuda.synchronize() function accepts an optional device index argument. The function internally queries the number of available CUDA devices and then uses the provided index to synchronize a specific GPU. However, the code does not check whether the index is within the valid range [0, num_devices - 1]. Passing a negative value, a value equal to or greater than the device count, or a value that causes an integer overflow can lead to:

• Out-of-bounds memory access – reading or writing to invalid memory locations.
• Driver-level crash – the CUDA driver may panic or hang.
• Infinite loop or deadlock – the synchronization call may never return.

The root cause is in the C++ backend, likely in a function similar to:

void SynchronizeDevice(int device_id) {
    cudaSetDevice(device_id);  // No validation
    cudaDeviceSynchronize();
}

If device_id is invalid, cudaSetDevice returns an error code that is ignored, and subsequent cudaDeviceSynchronize may crash the process.

Vulnerable vs. Patched Code

Vulnerable (OneFlow v0.9.0):

# flow/cuda/__init__.py (simplified)
def synchronize(device=None):
    if device is None:
        cuda_runtime.synchronize_all()
    else:
        cuda_runtime.synchronize_device(device)  # No validation

Patched (hypothetical fix):

# flow/cuda/__init__.py (patched)
def synchronize(device=None):
    if device is None:
        cuda_runtime.synchronize_all()
    else:
        num_devices = cuda_runtime.get_device_count()
        if not (0 <= device < num_devices):
            raise ValueError(f"Invalid device index {device}. Must be between 0 and {num_devices-1}.")
        cuda_runtime.synchronize_device(device)

The patch adds a bounds check before calling the underlying CUDA API.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, the following Python script demonstrates the vulnerability:

import oneflow as flow

# Trigger DoS by passing an invalid device index
try:
    flow.cuda.synchronize(device=9999)  # Out-of-range
except Exception as e:
    print(f"Exception caught: {e}")
    # In vulnerable version, this may crash instead of raising an exception

Expected behavior: The process crashes with a CUDA error or hangs indefinitely.

Blue Team (Detection & Hardening)

• Monitor logs for CUDA driver errors or unexpected process terminations.
• Use eBPF to trace calls to cudaSetDevice and cudaDeviceSynchronize with suspicious device IDs.
• Implement runtime guards in wrapper scripts that validate device indices before calling OneFlow APIs.
• Sandbox OneFlow processes to limit the impact of a crash.

Indicators of Compromise (IOCs)

• Process crash logs containing CUDA_ERROR_INVALID_DEVICE or cudaErrorInvalidDevice.
• Application hang – process remains in D state (uninterruptible sleep) for extended periods.
• Syslog entries from the NVIDIA driver indicating invalid device access.
• File system artifacts: core dumps from the OneFlow process.

Detection Engineering

YARA Rule

rule CVE_2025_65890_OneFlow_DoS {
    meta:
        description = "Detects OneFlow v0.9.0 CUDA synchronize vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:example"
    strings:
        $s1 = "flow.cuda.synchronize" ascii wide nocase
        $s2 = "cudaSetDevice" ascii wide nocase
        $s3 = "cudaDeviceSynchronize" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: OneFlow CUDA Synchronize DoS Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2025-65890 by calling synchronize with invalid device index
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: 'python3'
        CommandLine|contains: 'flow.cuda.synchronize'
    condition: selection
falsepositives:
    - Legitimate use with valid device indices
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65890 OneFlow DoS Attempt"; flow:to_server; content:"flow.cuda.synchronize"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Upgrade to a patched version of OneFlow once available. Monitor the official repository for updates.
• Workaround: Wrap all calls to flow.cuda.synchronize() with input validation in your application code.
• Compensating controls: Run OneFlow processes with restricted permissions and resource limits (e.g., ulimit). Use containerization to isolate the impact.
• Long-term: Implement input validation in all public APIs that accept device indices. Add unit tests for boundary conditions.

Valters IT
DevSecOps & Cyber Threat Intelligence