Description

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T21:17:11.517Z",
  "pubdate": "2026-08-20T21:17:11.517Z",
  "executiveSummary": "Tor before version 0.4.9.9 is vulnerable to a NULL write after free vulnerability, tracked as TROVE-2026-017.\nThe vulnerability arises when sending a CONFLUX_SWITCH cell fails, leading to improper error handling and memory corruption.\nThe primary impact of this flaw is a denial of service via application crash, triggered by writing to a deallocated memory region.\nAffected systems include the Tor anonymity network daemon across vulnerable versions prior to 0.4.9.9.\nRisk implications center on potential service disruption of Tor relays or clients if an attacker can induce cell send failures.\nAttacker capabilities involve leveraging conditions that cause the transmission of a CONFLUX_SWITCH cell to fail within the conflux subsystem.\nExploitation requirements include triggering the specific code path where relay_send_command_from_edge() fails and the return value goes unchecked.",
  "technicalDetails": "The root cause of TROVE-2026-017 is inadequate error handling within Tor's conflux leg switching logic, specifically concerning the return value of the function relay_send_command_from_edge().\nWhen the application attempts to send a CONFLUX_SWITCH cell and the transmission fails, relay_send_command_from_edge() internally invokes circuit_mark_for_close() and removes the associated circuit leg via the cfx_del_leg() function.\nThe calling function fails to check the return status of relay_send_command_from_edge() and proceeds under the assumption that the operation succeeded.\nConsequently, the execution flow attempts to write data to the current circuit leg, which has already been freed during the failed transmission attempt.\nThis sequence of operations results in a NULL write after free condition, immediately causing a segmentation fault and crashing the Tor process.\nThe vulnerable component resides within the Tor networking stack handling conflux cell management and relay command execution.\nAffected versions comprise all Tor releases prior to 0.4.9.9.\nAuthentication and privilege requirements depend on the execution context of the Tor instance, typically requiring no specialized privileges to trigger if reachable via protocol message handling.\nNetwork exposure is inherent to the Tor protocol handling mechanisms responsible for processing conflux stream and circuit operations.\nThe attack flow proceeds as follows: 1) The system initiates the transmission of a CONFLUX_SWITCH cell. 2) The transmission fails within relay_send_command_from_edge(). 3) The failure handler marks the circuit for closure and frees the leg via cfx_del_leg(). 4) The caller ignores the error status and writes to the freed leg reference. 5) Memory corruption triggers a fatal application crash."
}