CVE-2017-8823: Use After Free
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8823?
CVE-2017-8823 is classified as a moderate severity vulnerability due to the potential for exploitation through a use-after-free error in the Tor onion service.
How do I fix CVE-2017-8823?
To fix CVE-2017-8823, you should upgrade to Tor version 0.3.5.16 or later, as well as apply any necessary updates provided by your operating system.
Which versions of Tor are affected by CVE-2017-8823?
CVE-2017-8823 affects all Tor versions prior to 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9.
Are there any specific operating systems impacted by CVE-2017-8823?
CVE-2017-8823 impacts Tor installations on Debian Linux versions 8.0 and 9.0, along with other systems running the affected Tor versions.
What kind of vulnerability is CVE-2017-8823?
CVE-2017-8823 is a use-after-free vulnerability that occurs during the introduction point expiration in Tor onion services.