Executive Summary

CVE-2025-71009 is an input validation vulnerability in the OneFlow deep learning framework's flow.scatter and flow.scatter_add APIs. When these functions receive out-of-bound indices, instead of safely handling the error, the system crashes and aborts with a core dump due to missing bounds checking. This causes a fatal error and abrupt termination of the program, which is undesirable and poses stability and security risks. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your application using OneFlow's flow.scatter or flow.scatter_add functions to crash unexpectedly when given crafted out-of-bound indices. This leads to a Denial of Service (DoS) condition, where the program aborts with a core dump, potentially disrupting services, causing data loss, or impacting system stability. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or core dumps in applications using OneFlow v0.9.0, specifically when using the flow.scatter or flow.scatter_add APIs. Look for fatal errors logged from dim_scatter_kernel_util.h at line 181 indicating an "UNIMPLEMENTED" error due to out-of-bounds indices. To reproduce or detect the issue, you can run test code that calls flow.scatter or flow.scatter_add with deliberately out-of-bound index tensors (e.g., an index value of 10000 against a tensor dimension size of 5) and observe if the program crashes. There are no specific network commands, but monitoring application logs and crash reports is key. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use of flow.scatter and flow.scatter_add APIs with unvalidated or potentially out-of-bound indices in OneFlow v0.9.0. Implement input validation to ensure indices are within valid tensor dimensions before calling these functions. Additionally, monitor for updates or patches from OneFlow that address this bounds checking issue and apply them as soon as they become available. Until a fix is applied, consider adding exception handling or input sanitization in your code to prevent crashes. [1]

Useful 0 Not Useful 0