Use-after-free in Tor - CVE-2018-0491

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.

Affected software

How to mitigate CVE-2018-0491

Links to Public Exploits and PoC-codes

• Exploit #6400 - Tor Browser < 0.3.2.10 - Use After Free (PoC) (June 17, 2021)

External References

• https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915
• https://trac.torproject.org/projects/tor/ticket/24700
• https://trac.torproject.org/projects/tor/ticket/25117
• https://www.exploit-db.com/exploits/44994/

Related Security Bulletins

• Use-after-free in tor.eff Tor
• Use-after-free in tor (Alpine package)
• Fedora EPEL 6 update for tor