CVE-2024-35313
📋 TL;DR
This vulnerability in Tor Arti allows circuits to incorrectly have a length of 3 when full vanguards are enabled, potentially reducing anonymity protections. It affects users running Tor Arti versions before 1.2.3. The issue could allow attackers to more easily deanonymize Tor users.
💻 Affected Systems
- Tor Arti
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deanonymize Tor users by exploiting shorter-than-expected circuit lengths, compromising privacy and potentially exposing user identities.
Likely Case
Reduced anonymity protection for Tor users, making traffic analysis and deanonymization attacks more feasible.
If Mitigated
With proper patching, the vulnerability is eliminated and normal circuit length protections are restored.
🎯 Exploit Status
Exploitation requires network position and timing to observe circuit behavior
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.3
Vendor Advisory: https://gitlab.torproject.org/tpo/core/arti/-/issues/1400
Restart Required: Yes
Instructions:
1. Update Tor Arti to version 1.2.3 or later
2. Restart the Arti service
3. Verify the update was successful
🔧 Temporary Workarounds
Disable full vanguards
allTemporarily disable the full vanguards feature until patching is possible
arti --disable-full-vanguards
🧯 If You Can't Patch
- Consider using alternative Tor implementations temporarily
- Monitor for unusual network activity or connection patterns
🔍 How to Verify
Check if Vulnerable:
Check Arti version with 'arti --version' and verify it's below 1.2.3Check Version:
arti --versionVerify Fix Applied:
Confirm version is 1.2.3 or higher with 'arti --version'📡 Detection & Monitoring
Log Indicators:
- Unexpected circuit length of 3 in logs
- Vanguard-related errors
Network Indicators:
- Shorter-than-expected Tor circuit paths
SIEM Query:
Search for 'circuit length 3' or 'vanguard' in Arti logs