CVE-2024-36730
📋 TL;DR
This vulnerability in OneFlow v0.9.1 allows attackers to cause Denial of Service (DoS) by providing negative values to the oneflow.zeros/ones parameter. Improper input validation leads to resource exhaustion or crashes. Users of OneFlow v0.9.1 who process untrusted input are affected.
💻 Affected Systems
- OneFlow-Inc. Oneflow
📦 What is this software?
Oneflow by Oneflow
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion or application crash, potentially affecting dependent systems.
Likely Case
Service disruption or degraded performance when malicious inputs are processed.
If Mitigated
Minimal impact with proper input validation and monitoring in place.
🎯 Exploit Status
Simple exploitation via crafted inputs; public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.9.2 or later
Vendor Advisory: https://github.com/Oneflow-Inc/oneflow/security/advisories
Restart Required: Yes
Instructions:
1. Check current OneFlow version. 2. Update to v0.9.2 or later via package manager. 3. Restart affected services.
🔧 Temporary Workarounds
Input Validation Wrapper
allImplement custom input validation to reject negative values before passing to oneflow.zeros/ones.
# Python example: def safe_zeros(shape):
# if any(dim < 0 for dim in shape):
# raise ValueError('Negative dimensions not allowed')
# return oneflow.zeros(shape)
🧯 If You Can't Patch
- Implement strict input validation for all user-provided parameters.
- Monitor system resources and logs for unusual activity indicating exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check if OneFlow version is v0.9.1 using 'pip show oneflow' or similar.Check Version:
pip show oneflow | grep VersionVerify Fix Applied:
Confirm version is v0.9.2 or later and test with negative inputs to ensure proper error handling.📡 Detection & Monitoring
Log Indicators:
- Error logs showing crashes or resource exhaustion in OneFlow processes.
- Unusual patterns of negative parameter values in application logs.
Network Indicators:
- Increased error rates or timeouts in services using OneFlow.
SIEM Query:
source='application.log' AND ('oneflow' AND ('crash' OR 'error' OR 'negative'))