CVE-2021-34548
📋 TL;DR
This vulnerability in Tor allows attackers to forge RELAY_END or RELAY_RESOLVED messages to bypass access controls for ending streams. It affects Tor clients and relays running versions before 0.4.6.5, potentially enabling unauthorized stream termination and connection manipulation.
💻 Affected Systems
- Tor
📦 What is this software?
Tor by Torproject
Tor by Torproject
Tor by Torproject
Tor by Torproject
⚠️ Risk & Real-World Impact
Worst Case
Attackers could forcibly terminate Tor connections, disrupt anonymity, deanonymize users, or manipulate traffic flows between Tor nodes.
Likely Case
Temporary connection disruptions, stream termination, and potential degradation of Tor network reliability.
If Mitigated
Minimal impact with proper patching; isolated connection issues if exploited.
🎯 Exploit Status
Exploit requires network access to Tor traffic and understanding of Tor protocol. Public proof-of-concept available in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.6.5 and later
Vendor Advisory: https://blog.torproject.org/node/2041
Restart Required: Yes
Instructions:
1. Update Tor to version 0.4.6.5 or later using your package manager. 2. For Linux: 'sudo apt update && sudo apt upgrade tor' (Debian/Ubuntu) or 'sudo yum update tor' (RHEL/CentOS). 3. Restart Tor service: 'sudo systemctl restart tor' or restart the Tor process.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Tor traffic from untrusted networks to reduce attack surface
🧯 If You Can't Patch
- Implement network monitoring for abnormal Tor connection terminations
- Consider temporarily disabling Tor services if critical systems are affected
🔍 How to Verify
Check if Vulnerable:
Check Tor version with 'tor --version' or check running process versionCheck Version:
tor --versionVerify Fix Applied:
Verify version is 0.4.6.5 or higher and check for successful restart📡 Detection & Monitoring
Log Indicators:
- Unexpected stream terminations
- Abnormal RELAY_END or RELAY_RESOLVED messages in Tor logs
Network Indicators:
- Suspicious Tor protocol manipulation
- Unexpected connection resets in Tor traffic
SIEM Query:
source="tor.log" AND ("RELAY_END" OR "RELAY_RESOLVED") AND frequency abnormal🔗 References
- http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html
- https://blog.torproject.org/node/2041
- https://gitlab.torproject.org/tpo/core/tor/-/issues/40389
- https://security.gentoo.org/glsa/202107-25
- http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html
- https://blog.torproject.org/node/2041
- https://gitlab.torproject.org/tpo/core/tor/-/issues/40389
- https://security.gentoo.org/glsa/202107-25
