Executive Summary

This vulnerability is an input validation flaw in the OneFlow deep learning framework version 0.9.0, specifically in the tensor creation functions flow.Tensor.new_empty(), flow.Tensor.new_ones(), and flow.Tensor.new_zeros(). When these functions are called with negative tensor dimensions, which are invalid, the internal logic calculating the total number of elements (elem_cnt) results in a negative value. This causes the program to fail internal checks and abort, leading to a crash. For example, flow.Tensor.new_empty() accepts a negative dimension initially but crashes later, while flow.Tensor.new_ones() and flow.Tensor.new_zeros() immediately abort with a core dump. This results in a denial-of-service condition by causing the OneFlow process to terminate unexpectedly. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial-of-service (DoS) condition in applications using the affected OneFlow tensor creation APIs. By providing crafted inputs with negative tensor dimensions, an attacker can cause the OneFlow process to abort unexpectedly, leading to crashes and instability. This can disrupt the availability and reliability of services or applications relying on OneFlow for deep learning tasks. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the OneFlow tensor creation functions with negative dimensions to observe if the process crashes or aborts. For example, running Python code that calls flow.Tensor.new_empty(), flow.Tensor.new_ones(), or flow.Tensor.new_zeros() with negative dimensions (e.g., -2) will trigger the issue. A sample test command in Python could be: ```python import oneflow as flow # This should cause a crash or abort if vulnerable flow.Tensor.new_ones([-2]) ``` Monitoring for core dumps or process aborts when such inputs are used can help detect the vulnerability. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include validating all inputs to the tensor creation functions to ensure that no negative dimensions are passed. Avoid using untrusted or malformed inputs that could contain negative dimensions. Additionally, consider updating OneFlow to a version where this vulnerability is fixed once available. Until then, implement input validation checks in your application code to prevent negative dimension values from reaching the vulnerable functions. [1]

Useful 0 Not Useful 0