Description

Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-20T21:17:10.810Z",
  "pubdate": "2026-08-20T21:17:10.810Z",
  "executiveSummary": "Tor before 0.4.9.10 suffers from a critical Conflux link management vulnerability identified as TROVE-2026-025, specifically involving improper state validation when processing CONFLUX_LINK cells.\nThe vulnerability manifests as a use-after-free (UAF) condition resulting from dangling circuit back-pointers when exit streams are improperly attached prior to establishing a conflux link.\nAffected systems include Tor network software versions prior to 0.4.9.10 that implement the conflux protocol.\nThe risk implications are severe, potentially leading to memory corruption, unstable daemon behavior, or arbitrary code execution within the context of the Tor process if an attacker successfully triggers the memory management flaw.\nAn authenticated or unauthenticated remote attacker with the capability to establish network connections and interact with the Tor circuit protocol can exploit this vulnerability.\nExploitation requires sending a specifically ordered sequence of control and relay cells over a maliciously constructed circuit, specifically transmitting a RELAY_COMMAND_BEGIN cell before a CONFLUX_LINK cell on a circuit that already has attached streams.",
  "technicalDetails": "The root cause of TROVE-2026-025 is the absence of rigorous state validation checks within the Tor circuit and conflux subsystem regarding the chronological ordering and preconditions of cell processing.\nSpecifically, Tor before 0.4.9.10 fails to reject a CONFLUX_LINK cell when it arrives on a circuit that already has active streams attached to it.\nThe affected component is responsible for managing multi-path conflux circuits and binding relay streams to underlying circuit structures.\nThe attack flow proceeds as follows: First, a malicious client establishes a circuit through the Tor network. Second, the client sends a RELAY_COMMAND_BEGIN cell on the circuit, which successfully attaches an exit stream to that specific circuit back-pointer. Third, the malicious client subsequently sends a CONFLUX_LINK cell on the same circuit.\nBecause the validation logic fails to reject the late-arriving CONFLUX_LINK cell, the internal circuit state transitions incorrectly while existing stream references and back-pointers are active.\nWhen the circuit is eventually torn down or freed, the improperly tracked state leaves a dangling circuit back-pointer associated with the orphaned exit stream.\nSubsequent operations attempting to reference or clean up the dangling pointer result in a use-after-free (UAF) condition, triggering memory corruption.\nThe vulnerability is exposed over the network via the Tor protocol interface.\nNo special authentication or high-level privileges are required beyond the baseline capability to connect to the target Tor instance and manipulate circuit creation and cell sequencing.\nPost-exploitation impact includes destabilization of the Tor relay or client daemon, denial of service through application crashes, and potential memory disclosure or code execution depending on heap layout stability."
}