CVE-2025-71000
📋 TL;DR
A vulnerability in OneFlow v0.9.0's flow.cuda.BoolTensor component allows attackers to cause Denial of Service (DoS) by sending specially crafted input. This affects systems running OneFlow with CUDA support enabled. The vulnerability can crash the application or service using this component.
💻 Affected Systems
- OneFlow
📦 What is this software?
Oneflow by Oneflow
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption causing extended downtime for applications relying on OneFlow's CUDA tensor operations.
Likely Case
Application crashes or hangs when processing malicious input through the vulnerable component.
If Mitigated
Limited impact with proper input validation and monitoring in place.
🎯 Exploit Status
CWE-400 indicates unconstrained resource consumption, suggesting relatively simple exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://github.com/Oneflow-Inc/oneflow/issues/10659
Restart Required: Yes
Instructions:
1. Monitor the GitHub issue for patch release. 2. Upgrade to patched version when available. 3. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for flow.cuda.BoolTensor operations
Disable CUDA Support
allTemporarily disable CUDA tensor operations if not required
🧯 If You Can't Patch
- Implement network segmentation to isolate systems running vulnerable OneFlow versions
- Deploy monitoring for abnormal resource consumption in CUDA tensor operations
🔍 How to Verify
Check if Vulnerable:
Check if running OneFlow v0.9.0 with CUDA support enabled and using flow.cuda.BoolTensorCheck Version:
python -c "import oneflow; print(oneflow.__version__)"Verify Fix Applied:
Verify upgrade to patched version and test CUDA BoolTensor operations with various inputs📡 Detection & Monitoring
Log Indicators:
- Application crashes
- High CPU/GPU usage spikes
- CUDA error messages
Network Indicators:
- Unusual input patterns to tensor processing endpoints
SIEM Query:
source="application.log" AND ("crash" OR "segfault" OR "CUDA error") AND "oneflow"