CVE-2025-71007
📋 TL;DR
An input validation vulnerability in OneFlow's oneflow.index_add component allows attackers to trigger a Denial of Service (DoS) by sending specially crafted inputs. This affects systems running OneFlow v0.9.0 where this component is used. The vulnerability can disrupt service availability without requiring authentication.
💻 Affected Systems
- OneFlow
📦 What is this software?
Oneflow by Oneflow
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability through resource exhaustion or crash, potentially affecting downstream applications and services.
Likely Case
Service disruption or performance degradation in applications using the vulnerable index_add function with untrusted input.
If Mitigated
Minimal impact if input validation is performed before passing data to the vulnerable function.
🎯 Exploit Status
Exploitation requires crafting specific inputs to trigger the vulnerability. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not yet released
Vendor Advisory: https://github.com/Oneflow-Inc/oneflow/issues/10652
Restart Required: Yes
Instructions:
1. Monitor the GitHub issue for patch release. 2. Upgrade to patched version when available. 3. Restart affected services after patching.
🔧 Temporary Workarounds
Input Validation Wrapper
allImplement input validation before calling oneflow.index_add to filter malicious inputs.
# Add validation logic in code before index_add calls
# Example: validate tensor dimensions and data types
Function Restriction
allRestrict access to APIs or endpoints that use the vulnerable index_add function.
# Implement access controls or disable affected endpoints
🧯 If You Can't Patch
- Implement strict input validation for all data passed to oneflow.index_add
- Monitor system resources and implement rate limiting on affected endpoints
🔍 How to Verify
Check if Vulnerable:
Check if running OneFlow v0.9.0 and if code uses oneflow.index_add function.Check Version:
python -c "import oneflow; print(oneflow.__version__)"Verify Fix Applied:
Verify upgrade to patched version when available and test index_add with various inputs.📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes or restarts of OneFlow services
- Error logs containing index_add failures or memory errors
Network Indicators:
- Unusual traffic patterns to endpoints using index_add function
SIEM Query:
source="oneflow.log" AND ("index_add" OR "crash" OR "segmentation fault")