CVE-2025-71011: OneFlow DoS Vulnerability

CVE-2025-71011 Overview

An input validation vulnerability has been identified in OneFlow v0.9.0, a popular deep learning framework. The vulnerability exists in the flow.Tensor.new_empty, flow.Tensor.new_ones, and flow.Tensor.new_zeros components, which are fundamental tensor creation functions used throughout the framework. Attackers can exploit this flaw by supplying crafted input to these functions, leading to a Denial of Service (DoS) condition.

Critical Impact

This vulnerability allows attackers with local access to cause application crashes and service disruption by exploiting improper input validation in core tensor operations.

Affected Products

• OneFlow v0.9.0
• Applications and services built on OneFlow v0.9.0 tensor operations

Discovery Timeline

• 2026-01-29 - CVE CVE-2025-71011 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-71011

Vulnerability Analysis

This vulnerability is classified as CWE-20 (Improper Input Validation), indicating that the affected tensor creation functions fail to properly validate input parameters before processing. The flow.Tensor.new_empty, flow.Tensor.new_ones, and flow.Tensor.new_zeros functions are designed to create new tensors based on existing tensor properties, but they do not adequately sanitize or validate the input arguments provided by users.

When a crafted malicious input is supplied to these functions, the lack of proper validation leads to unexpected behavior that crashes the application or causes resource exhaustion, resulting in a denial of service condition. This is particularly concerning in deep learning environments where tensor operations are fundamental to model training and inference pipelines.

Root Cause

The root cause of this vulnerability is improper input validation within the tensor creation methods. The new_empty, new_ones, and new_zeros functions accept parameters such as tensor dimensions, data types, and device specifications without adequately checking for boundary conditions, invalid values, or malformed input structures. This oversight allows attackers to pass specially crafted arguments that trigger undefined behavior or resource exhaustion within the OneFlow runtime.

Attack Vector

The attack requires local access to execute, meaning an attacker must be able to run code on a system where OneFlow is installed. The exploitation does not require any privileges or user interaction, making it relatively straightforward to trigger once local access is obtained. An attacker would craft malicious input parameters—such as invalid dimension sizes, corrupted tensor references, or unexpected data types—and pass them to the vulnerable tensor creation functions.

The vulnerability specifically targets the availability of the system, causing the OneFlow application to crash or become unresponsive. This could disrupt machine learning training jobs, inference services, or any application relying on OneFlow for tensor computations.

Detection Methods for CVE-2025-71011

Indicators of Compromise

• Unexpected crashes or exceptions in OneFlow applications during tensor creation operations
• Abnormal resource utilization patterns when new_empty, new_ones, or new_zeros functions are invoked
• Application logs showing errors related to tensor dimension validation or memory allocation failures
• Repeated service restarts or availability issues in OneFlow-based services

Detection Strategies

• Monitor application logs for exceptions originating from tensor creation functions in OneFlow
• Implement input validation at the application layer before passing parameters to OneFlow tensor operations
• Deploy runtime monitoring to detect abnormal behavior patterns in deep learning pipelines
• Use SentinelOne Singularity Platform to detect and alert on unusual process crashes or resource exhaustion patterns

Monitoring Recommendations

• Configure application-level logging to capture all tensor operation inputs and outputs
• Set up alerts for repeated application crashes or service restarts involving OneFlow processes
• Monitor system resource metrics (memory, CPU) for anomalies during tensor operations
• Implement health checks for OneFlow-based services to detect availability degradation

How to Mitigate CVE-2025-71011

Immediate Actions Required

• Review all code paths that utilize flow.Tensor.new_empty, flow.Tensor.new_ones, and flow.Tensor.new_zeros functions
• Implement application-layer input validation to sanitize tensor parameters before passing to OneFlow
• Consider isolating OneFlow processes in sandboxed environments to limit DoS impact
• Monitor the OneFlow GitHub repository for updates and patches addressing this vulnerability

Patch Information

No official patch information is currently available. Users should monitor the OneFlow GitHub Issue Discussion for updates regarding a fix. Consider upgrading to newer versions of OneFlow when patches become available.

Workarounds

• Implement strict input validation in application code before calling vulnerable tensor functions
• Add boundary checks for tensor dimensions and validate data types before tensor creation
• Use try-catch exception handling around tensor operations to gracefully handle crashes
• Limit access to systems running OneFlow to trusted users only
• Consider containerizing OneFlow workloads to contain potential DoS impacts

# Example: Input validation before tensor operations
# Validate tensor dimensions before calling OneFlow functions
# Ensure size parameters are positive integers within acceptable bounds
# Implement rate limiting for tensor creation requests in production services