CVE-2025-71008: OneFlow DoS Vulnerability via Segfault

CVE-2025-71008 Overview

A segmentation violation vulnerability exists in OneFlow v0.9.0, specifically within the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component. This vulnerability allows attackers with local access to cause a Denial of Service (DoS) condition by providing specially crafted input to the affected function. The vulnerability results from improper memory handling that leads to a segmentation fault, causing the application to crash.

Critical Impact

Local attackers can cause complete service disruption through crafted input that triggers a segmentation violation in the OneFlow autograd functionality, resulting in application crashes and denial of service.

Affected Products

• OneFlow v0.9.0
• OneFlow autograd module (oneflow._oneflow_internal.autograd)
• Applications utilizing FunctionCtx.mark_non_differentiable component

Discovery Timeline

• 2026-01-29 - CVE CVE-2025-71008 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-71008

Vulnerability Analysis

This vulnerability resides in the autograd (automatic differentiation) subsystem of OneFlow, a deep learning framework. The mark_non_differentiable function is used within custom autograd functions to indicate that certain output tensors should not have gradients computed. When this function receives malformed or unexpected input, it fails to properly validate the data before processing, leading to an invalid memory access that manifests as a segmentation violation.

The local attack vector indicates that exploitation requires the attacker to have local access to the system running OneFlow. This could occur in shared computing environments, multi-tenant machine learning platforms, or scenarios where users can submit arbitrary model code for execution.

Root Cause

The root cause of this vulnerability is a failure to properly validate input parameters within the mark_non_differentiable function. When the function receives crafted input that violates expected constraints—such as null pointers, incorrectly typed objects, or tensors with invalid memory references—the code attempts to dereference invalid memory locations, resulting in a segmentation fault.

This type of memory safety issue is common in native code components that interface with Python, where type checking and boundary validation may not be enforced at the language boundary.

Attack Vector

The attack vector is local, requiring the attacker to execute code on the target system. An attacker can exploit this vulnerability by:

1. Crafting malicious input that triggers the vulnerable code path in mark_non_differentiable
2. Executing the crafted payload within a OneFlow context, such as during model training or inference
3. Causing the OneFlow process to crash due to the segmentation violation

In shared computing environments like cloud-based ML platforms or research clusters, this could be leveraged to disrupt other users' workloads or cause service interruptions.

The vulnerability is documented in GitHub Issue #10651, which provides additional context on the issue.

Detection Methods for CVE-2025-71008

Indicators of Compromise

• Unexpected process crashes in OneFlow applications with segmentation fault (SIGSEGV) signals
• Core dump files generated by OneFlow processes containing references to mark_non_differentiable or autograd functions
• Repeated application restarts or service interruptions in ML pipeline infrastructure

Detection Strategies

• Monitor for SIGSEGV signals in OneFlow application logs and system journals
• Implement crash reporting mechanisms that capture stack traces pointing to oneflow._oneflow_internal.autograd module
• Deploy application-level monitoring to detect abnormal crash rates in ML workloads
• Review submitted model code and training scripts for suspicious calls to mark_non_differentiable with unusual parameters

Monitoring Recommendations

• Enable core dump collection and analysis for OneFlow processes to identify exploitation attempts
• Implement process monitoring to detect and alert on repeated crashes in ML infrastructure
• Log all autograd function invocations in security-sensitive environments
• Monitor for unusual patterns of service restarts or resource consumption spikes

How to Mitigate CVE-2025-71008

Immediate Actions Required

• Audit systems running OneFlow v0.9.0 and identify critical workloads that may be affected
• Implement input validation and sandboxing for user-submitted ML code in shared environments
• Monitor the OneFlow GitHub repository for patch releases addressing this vulnerability
• Consider isolating OneFlow workloads in containerized environments to limit the impact of crashes

Patch Information

As of the last update on 2026-01-29, users should monitor the OneFlow project for official patches. The issue is tracked in GitHub Issue #10651. Users are advised to:

1. Watch the OneFlow repository for security updates
2. Upgrade to patched versions when available
3. Review the GitHub issue for any community-provided workarounds or hotfixes

Workarounds

• Implement input validation wrappers around mark_non_differentiable calls to filter potentially malicious inputs
• Run OneFlow processes with resource limits and automatic restart policies to minimize DoS impact
• Deploy process isolation using containers or sandboxing technologies to contain crash impacts
• Restrict access to ML infrastructure to trusted users only in multi-tenant environments

# Example: Run OneFlow in a container with restart policies and resource limits
docker run --restart=on-failure:3 \
  --memory="8g" \
  --cpus="4" \
  --security-opt=no-new-privileges \
  oneflow/oneflow:v0.9.0 python your_model.py