Tor Out-of-Bounds Read Vulnerability in BEGIN Cells

A vulnerability allowing an out-of-bounds read by one byte has been identified in Tor versions prior to 0.4.9.7. This issue arises when a malformed BEGIN cell is received, leading to an off-by-one read error.

Impact

Exploitation of this vulnerability causes an out-of-bounds read, which can potentially be leveraged to read memory outside the intended buffer, leading to undefined behavior or information disclosure.

Reproduction

The vulnerability can be reproduced by sending a malformed BEGIN cell that omits the last flag byte. This omission triggers the off-by-one out-of-bounds read, as the parsing logic incorrectly evaluates the cell's length, allowing it to read beyond the allocated buffer.

Remediation

Users are advised to upgrade to Tor version 0.4.9.7 or later, where this vulnerability has been fixed.