CVE-2025-70999

Executive Summary

CVE-2025-70999 is a denial-of-service vulnerability in the OneFlow machine learning framework, version 0.9.0. The flaw resides in the flow.cuda.get_device_capability() function, which fails to properly validate GPU device IDs provided by the user. An attacker with local access to a system running OneFlow can supply a crafted, out-of-range device ID, causing the function to crash or hang, leading to a denial of service. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the local attack vector and potential for service disruption. No public exploit code or patch is currently available.

Supply Chain & Package Security

OneFlow is a PyPI package (oneflow) used for deep learning. This vulnerability affects the supply chain as users who install version 0.9.0 from PyPI are exposed. The package is not widely used but is critical for organizations relying on it for ML workloads. No malicious package versions have been reported, but the lack of a patch increases supply chain risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): Low (L) – Attacker needs user-level access.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Service becomes unavailable.

Threat Level: Medium. Exploitation requires local access but can disrupt ML training/inference pipelines.

Deep Dive & Mechanics

The vulnerability is in the flow.cuda.get_device_capability() function, which queries the compute capability of a CUDA device. The function accepts a device ID as an integer argument. In the vulnerable code, there is no bounds checking on the device ID before it is passed to the CUDA runtime API. If an attacker provides a device ID that is negative or exceeds the number of available GPUs, the CUDA driver may return an error that is not handled, causing the OneFlow process to crash or enter an infinite loop.

The root cause is improper input validation (CWE-20). The function should validate that the device ID is within the range [0, num_devices - 1] before calling the CUDA API.

Vulnerable vs. Patched Code

Vulnerable Code (OneFlow v0.9.0):

def get_device_capability(device_id: int) -> tuple:
    # No validation of device_id
    major, minor = cuda_runtime_get_device_capability(device_id)
    return major, minor

Patched Code (Hypothetical):

def get_device_capability(device_id: int) -> tuple:
    num_devices = cuda_runtime_get_device_count()
    if device_id < 0 or device_id >= num_devices:
        raise ValueError(f"Invalid device ID: {device_id}. Must be between 0 and {num_devices - 1}.")
    major, minor = cuda_runtime_get_device_capability(device_id)
    return major, minor

Exploitation & Lab Setup

Red Team

Prerequisites: Local user access to a system running OneFlow v0.9.0 with CUDA drivers installed.

Exploit Steps:

1. Identify the OneFlow process (e.g., ps aux | grep oneflow).
2. Execute a Python script that calls the vulnerable function with a crafted device ID:

   import oneflow as flow
   # Trigger DoS with negative device ID
   flow.cuda.get_device_capability(-1)
   # Or with an out-of-range positive ID
   flow.cuda.get_device_capability(9999)
   

3. The OneFlow process will crash or become unresponsive, causing denial of service.

Expected Outcome: The OneFlow service stops responding to legitimate requests.

Blue Team

Detection:

• Monitor for abnormal process crashes or hangs in OneFlow.
• Look for logs containing get_device_capability with unusual device IDs.

Mitigation:

• Restrict local access to systems running OneFlow.
• Use application-level input validation (if source code is available).
• Consider using a containerized environment with strict resource limits.

Indicators of Compromise (IOCs)

• Process Crash: OneFlow process terminates unexpectedly with a CUDA error.
• Log Entries: Application logs showing get_device_capability called with negative or large device IDs.
• System Logs: Kernel or CUDA driver logs indicating invalid device access.

Detection Engineering

YARA Rule

rule CVE_2025_70999_OneFlow_DoS {
    meta:
        description = "Detects exploitation attempts of CVE-2025-70999 in OneFlow"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-70999"
    strings:
        $s1 = "get_device_capability" ascii wide nocase
        $s2 = "device_id" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: OneFlow CUDA Device ID Validation DoS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2025-70999 by calling get_device_capability with invalid device IDs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: oneflow
detection:
    selection:
        EventID: 1000  # Example: process crash event
        Data: "*get_device_capability*"
    condition: selection
falsepositives:
    - Legitimate use of negative device IDs (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-70999 OneFlow CUDA DoS Attempt"; content:"get_device_capability"; nocase; content:"-1"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Restrict local access to systems running OneFlow v0.9.0.
• Monitor for abnormal process behavior.
• If possible, apply input validation at the application level (e.g., wrap the function with a check).

Long-term:

• Upgrade to a patched version when available.
• Consider switching to an alternative ML framework if OneFlow remains unpatched.
• Implement runtime security monitoring for CUDA API calls.

Workaround: None available.

Valters IT