CVE-2025-71008

Executive Summary

CVE-2025-71008 is a denial-of-service (DoS) vulnerability in OneFlow v0.9.0, specifically within the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component. The vulnerability is triggered by a crafted input that causes a segmentation violation, leading to a crash of the application. No patch is currently available, and no public proof-of-concept (PoC) code has been released. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

OneFlow is a deep learning framework distributed via PyPI. Users should verify the integrity of their installed packages and monitor for updates. The vulnerability affects version 0.9.0 only; earlier or later versions may not be impacted. Organizations using OneFlow in production should consider isolating the environment or applying workarounds until a patch is released.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, but this is likely due to incomplete data. Based on the nature of the vulnerability (segmentation violation leading to DoS), a reasonable CVSS vector would be:

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – complete loss of availability.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Threat Level: Medium (due to low EPSS and no public exploit, but potential for disruption in ML pipelines).

Deep Dive & Mechanics

The vulnerability resides in the mark_non_differentiable method of the FunctionCtx class within OneFlow's autograd engine. This method is used to mark tensors as non-differentiable during the forward pass of a custom autograd function. A segmentation violation (segfault) occurs when the method is called with a crafted input that causes an invalid memory access.

Root Cause: The function likely fails to validate the input tensor's metadata (e.g., shape, dtype, or device) before dereferencing pointers. An attacker can provide a tensor with malformed attributes, leading to a null pointer dereference or out-of-bounds access.

Attack Vector: An attacker with local access to a system running OneFlow v0.9.0 can craft a malicious input to a custom autograd function that calls mark_non_differentiable. This causes the OneFlow process to crash, resulting in a denial of service.

Impact: The primary impact is availability. The crash can disrupt machine learning training or inference pipelines, potentially causing data loss or service downtime.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a hypothetical fix would involve adding input validation checks before processing the tensor in mark_non_differentiable. For example:

Vulnerable Code (hypothetical):

def mark_non_differentiable(self, tensor):
    # No validation
    self.non_diff_tensors.append(tensor)
    # Direct pointer dereference without checking tensor validity
    tensor._impl.mark_non_differentiable()

Patched Code (hypothetical):

def mark_non_differentiable(self, tensor):
    if not isinstance(tensor, oneflow.Tensor):
        raise TypeError("Expected a oneflow.Tensor")
    if tensor._impl is None:
        raise ValueError("Tensor implementation is None")
    self.non_diff_tensors.append(tensor)
    tensor._impl.mark_non_differentiable()

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service by crashing the OneFlow process.

Prerequisites:

• Local access to a system with OneFlow v0.9.0 installed.
• Ability to execute Python code.

Steps:

1. Create a custom autograd function that calls mark_non_differentiable with a crafted tensor.
2. Execute the function to trigger the segmentation violation.

Example Exploit Code:

import oneflow as flow
from oneflow._oneflow_internal.autograd import Function

class MaliciousFunction(Function):
    @staticmethod
    def forward(ctx, input):
        # Craft a tensor with invalid metadata
        crafted_tensor = flow.tensor([1.0])
        # Manipulate internal state to cause segfault
        crafted_tensor._impl = None  # Hypothetical manipulation
        ctx.mark_non_differentiable(crafted_tensor)
        return input

    @staticmethod
    def backward(ctx, grad_output):
        return grad_output

# Trigger the vulnerability
input = flow.tensor([1.0], requires_grad=True)
output = MaliciousFunction.apply(input)

Note: The exact manipulation required may vary. This is a conceptual example.

Blue Team

Detection:

• Monitor for crashes in OneFlow processes (e.g., segfaults in logs).
• Use process monitoring tools to detect abnormal terminations.

Mitigation:

• Restrict local access to systems running OneFlow.
• Use containerization (e.g., Docker) with resource limits to contain crashes.
• Implement input validation in custom autograd functions.

Forensics:

• Collect core dumps from crashes for analysis.
• Review logs for patterns of repeated crashes.

Indicators of Compromise (IOCs)

• Process Crash: OneFlow process terminates with signal SIGSEGV (11).
• Log Entry: Segmentation fault (core dumped) in system logs.
• File Artifacts: Core dump files (e.g., core.12345) in the working directory.
• Network: No network indicators (local vulnerability).

Detection Engineering

YARA Rule

rule CVE_2025_71008_OneFlow_Segfault {
    meta:
        description = "Detects OneFlow v0.9.0 process crashes due to CVE-2025-71008"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-71008"
    strings:
        $segfault = "SIGSEGV" nocase
        $oneflow = "oneflow" nocase
        $mark_non_diff = "mark_non_differentiable" nocase
    condition:
        $segfault and $oneflow and $mark_non_diff
}

Sigma Rule

title: OneFlow Segmentation Violation Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes in OneFlow v0.9.0 due to CVE-2025-71008
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'oneflow'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-71008 OneFlow DoS Attempt"; flow:to_server; content:"mark_non_differentiable"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Run OneFlow v0.9.0 in a sandboxed environment (e.g., Docker container with limited resources).
2. Monitor: Enable crash reporting and monitor for segfaults.
3. Restrict Access: Limit local access to systems running OneFlow to trusted users only.

Long-term Fix:

• Await an official patch from OneFlow. Once available, upgrade to the patched version.
• If no patch is released, consider migrating to an alternative deep learning framework (e.g., PyTorch, TensorFlow).

Workaround:

• Avoid using custom autograd functions that call mark_non_differentiable with untrusted input.
• Implement input validation in custom functions to reject malformed tensors.

Valters IT
Securing Digital Frontiers