CVE-2018-25022: Infoleak
The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP address (when knowing only their Tox Id) by positioning themselves close to target's Tox Id in the DHT for the target to establish an onion connection with the attacker, guessing the target's DHT public key and creating a DHT node with public key close to it, and finally onion-routing a NAT Ping Request to the target, requesting it to ping the just created DHT node.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25022?
CVE-2018-25022 is considered to have a high severity due to its potential for exposing user IP addresses.
How do I fix CVE-2018-25022?
To fix CVE-2018-25022, upgrade to Toxcore version 0.2.2 or later, which addresses the vulnerability.
What does CVE-2018-25022 affect?
CVE-2018-25022 affects the Onion module of Toxcore versions prior to 0.2.2.
What is the impact of CVE-2018-25022?
The impact of CVE-2018-25022 allows a remote attacker to discover a user's IP address by positioning themselves near the target's Tox Id.
Who is vulnerable to CVE-2018-25022?
Users of the Toxcore software prior to version 0.2.2 are vulnerable to CVE-2018-25022.