PT-2021-4124 · Tor+4 · Tor+4

Jann Horn · Published 2021-06-16 · Updated 2025-05-12 · CVE-2021-34549

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.6.5

Description An issue was discovered where hashing is mishandled for certain retrieval of circuit data. Consequently, an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency. This issue is related to the mishandling of hashing for circuit data retrieval, allowing an attacker to exploit it and cause inefficiency in the algorithm.

Recommendations For Tor versions prior to 0.4.6.5, update to version 0.4.6.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of circuit IDs to minimize the risk of exploitation.

Fix

Resource Exhaustion

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-400

CWE-755

Related Identifiers

ALT-PU-2021-2008

ALT-PU-2025-6362

BDU:2021-04715

CVE-2021-34549

DSA-4932-1

MGASA-2021-0293

OPENSUSE-SU-2021:0926-1

OPENSUSE-SU-2021:0941-1

OPENSUSE-SU-2021_0926-1

OPENSUSE-SU-2024:11469-1

USN-5036-1

Affected Products

Alt Linux

Linuxmint

Suse

Tor

Ubuntu

References · 61

• https://osv.dev/vulnerability/openSUSE-SU-2024:11469-1 · Vendor Advisory
• https://blog.torproject.org/node/2041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34549 · Security Note
• https://ubuntu.com/security/CVE-2021-38385 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0941-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4932-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0293.html · Security Note
• https://ubuntu.com/security/CVE-2021-34550 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34549 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/RST7YTNTKJURIR2QVIJMEBXWW2YHETRX · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34549 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5036-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34549 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28090 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-34549 · Security Note