CVE-2017-8823
HighSummary
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free vulnerability in onion service v2 during intro-point expiration due to mismanagement of the expiring list in certain error cases.
Risk Assessment
This vulnerability may lead to unauthorized memory access, potentially resulting in data leakage or service instability. Organizations using Tor should be aware of the potential risks associated with this flaw.
Recommendation
It is recommended to update to the latest version of Tor to mitigate this vulnerability. Regular monitoring and updating of software is crucial for maintaining security.
Other vulnerabilities in Tor
See all- CVE-2016-1254High
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
- CVE-2017-8821High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service (application hang) via crafted PEM input that signifies a public key requiring a password, triggering an attempt by the OpenSSL library to ask the user for the password.
- CVE-2017-8820High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service via a NULL pointer dereference, leading to application crash.
- CVE-2017-8819High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services. An attacker can send many INTRODUCE2 cells to trigger this issue.
- CVE-2017-0377High
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay, not the exit relay's family. This may allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
- CVE-2017-0375High
The hidden-service feature in Tor before version 0.3.0.8 allows a denial of service (assertion failure and daemon exit) via a malformed BEGIN cell.
- CVE-2016-8860High
Tor versions before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had functions that expected buf_t data to be NUL terminated. The implementation in or/buffers.c did not ensure this termination, allowing remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.
- CVE-2026-77642High
Tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities.
- CVE-2026-77641Medium
Tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. Ignoring the return value of relay_send_command_from_edge() leads to a crash.
- CVE-2026-77640Low
Tor before 0.4.9.9 can enter an infinite loop when decompressing a truncated zlib/gzip stream with done=1. The truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR, which is mistaken for a full output buffer.
Original NVD description (English source)
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.