CVE-2025-71009
BaseFortify
Publication date: 2026-01-29
Last updated on: 2026-02-03
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oneflow | oneflow | 0.9.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-71009 is an input validation vulnerability in the OneFlow deep learning framework's flow.scatter and flow.scatter_add APIs. When these functions receive out-of-bound indices, instead of safely handling the error, the system crashes and aborts with a core dump due to missing bounds checking. This causes a fatal error and abrupt termination of the program, which is undesirable and poses stability and security risks. [1]
How can this vulnerability impact me? :
This vulnerability can cause your application using OneFlow's flow.scatter or flow.scatter_add functions to crash unexpectedly when given crafted out-of-bound indices. This leads to a Denial of Service (DoS) condition, where the program aborts with a core dump, potentially disrupting services, causing data loss, or impacting system stability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for crashes or core dumps in applications using OneFlow v0.9.0, specifically when using the flow.scatter or flow.scatter_add APIs. Look for fatal errors logged from dim_scatter_kernel_util.h at line 181 indicating an "UNIMPLEMENTED" error due to out-of-bounds indices. To reproduce or detect the issue, you can run test code that calls flow.scatter or flow.scatter_add with deliberately out-of-bound index tensors (e.g., an index value of 10000 against a tensor dimension size of 5) and observe if the program crashes. There are no specific network commands, but monitoring application logs and crash reports is key. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of flow.scatter and flow.scatter_add APIs with unvalidated or potentially out-of-bound indices in OneFlow v0.9.0. Implement input validation to ensure indices are within valid tensor dimensions before calling these functions. Additionally, monitor for updates or patches from OneFlow that address this bounds checking issue and apply them as soon as they become available. Until a fix is applied, consider adding exception handling or input sanitization in your code to prevent crashes. [1]