Tor Out-of-Order Queue Accounting Vulnerability in Conflux Handling

A vulnerability exists in Tor versions prior to 0.4.9.7, where the accounting of the conflux out-of-order queue is improperly managed during the queue clearing process. This issue can lead to incorrect byte allocation accounting, particularly when a conflux set is dismantled while out-of-order cells are still queued.

Impact

The vulnerability can cause an out-of-bounds read and disrupt proper cell handling within the Tor network, potentially leading to memory management issues.

Reproduction

The vulnerability can be reproduced by creating a conflux set and allowing out-of-order cells to accumulate in the queue. Afterward, the conflux set can be torn down, which should ideally clear the queue and reset the accounting. However, due to the vulnerability, the accounting does not return to zero, even if the queue is not empty.

Remediation

Users are advised to upgrade to Tor version 0.4.9.7, which addresses this vulnerability by correcting the out-of-order queue accounting process.