CVE-2021-38385
📋 TL;DR
This vulnerability in Tor's signature verification implementation causes a remote assertion failure when processing specially crafted signatures. It affects all Tor clients and relays running vulnerable versions, potentially causing denial of service.
💻 Affected Systems
- Tor
📦 What is this software?
Tor by Torproject
Tor by Torproject
Tor by Torproject
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers can crash Tor processes, causing denial of service for users and disrupting Tor network operations.
Likely Case
Targeted attacks against Tor relays or clients causing service disruption and potential deanonymization if combined with other attacks.
If Mitigated
Minimal impact if patched; unpatched systems remain vulnerable to DoS attacks.
🎯 Exploit Status
Exploitation requires sending specially crafted signatures to trigger assertion failure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Tor 0.3.5.16, 0.4.5.10, and 0.4.6.7
Vendor Advisory: https://blog.torproject.org/node/2062
Restart Required: Yes
Instructions:
1. Stop Tor service. 2. Update Tor using package manager (apt/yum/brew) or compile from source. 3. Restart Tor service.
🔧 Temporary Workarounds
Disable Tor service
linuxTemporarily disable Tor to prevent exploitation
sudo systemctl stop tor
sudo service tor stop
🧯 If You Can't Patch
- Implement network filtering to block malicious traffic targeting Tor ports
- Monitor Tor process health and implement automatic restart on crash
🔍 How to Verify
Check if Vulnerable:
Check Tor version with 'tor --version' and compare against affected versionsCheck Version:
tor --versionVerify Fix Applied:
Verify version is 0.3.5.16, 0.4.5.10, or 0.4.6.7 or later📡 Detection & Monitoring
Log Indicators:
- Tor process crashes
- Assertion failure messages in logs
- Unexpected Tor restarts
Network Indicators:
- Unusual traffic patterns to Tor ports (default 9050, 9051, 9150)
SIEM Query:
process_name:tor AND (event_type:crash OR log_message:"assertion failure")🔗 References
- https://blog.torproject.org
- https://blog.torproject.org/node/2062
- https://bugs.torproject.org/tpo/core/tor/40078
- https://security.gentoo.org/glsa/202305-11
- https://blog.torproject.org
- https://blog.torproject.org/node/2062
- https://bugs.torproject.org/tpo/core/tor/40078
- https://security.gentoo.org/glsa/202305-11
